rproxy, the proxy in front of each app, asks servewaf and fails open (closes #171)

`smallwebwaf rproxy` reads the first 64 KiB of each body, asks servewaf, and
passes what servewaf allows to the app within its own size and time limits.
It reports each request servewaf answered. SWRP_DEFAULT_DISPOSITION decides
when servewaf gives no answer.

Duplication: internal/rproxy copies passing-on code from internal/proxy until
#172 removes the originals.
Rule suppressed: gosec G704 on servewaf's URL, a setting.
Rule suppressed: gosec G705 on the answer written to the visitor.
Judgement call: the SWRP_ size and time limits take off; SWRP_TIMEOUT_MS does not.

Model: opus-5-5

internal/config/config.go

@@ -1,7 +1,9 @@
-// Package config reads smallwebwaf's settings. Every setting is an
-// environment variable whose name starts with SWWAF_, or a file such a
-// variable names, every setting has a default, and this package is the
-// one place they are read.
+// Package config reads smallwebwaf's settings, and is the one place they are
+// read. Every setting is an environment variable. The settings of
+// `smallwebwaf` and `smallwebwaf servewaf` start with SWWAF_, every one of them
+// has a default, and each can be given as a file instead. Those of `smallwebwaf
+// rproxy` start with SWRP_. Each of them but SWRP_WAF_BACKEND has a default, and
+// none can be given as a file, since rproxy never touches disk.
 package config
 
 import (