waf: refuse request lines and header lines over 8 KiB first (closes #339)

The header limits now also refuse a request line over 8 KiB with 414
(action request_line_too_long) and a header line over 8 KiB, Host
included, with 431. Like the other header limits they are fixed, run
first and make no ban. One long query string or cookie no longer keeps
the Core Rule Set busy for a third of a second.

Model: opus-5-5

README.md

@@ -22,25 +22,7 @@ shipped in one image, with two commands that do this together:
 The site keeps answering while `waf` is down, slow or restarting: without an
 answer in time, `rproxy` passes the request to the app.
 
-`rproxy` also protects the app on its own, whether or not `waf` answers. It
+It protects against:
-limits the total size of a request's headers, but not their number: the limits
-on the number of headers and cookies, and on each header line's length, are
-`waf`'s. With the default settings, `rproxy`:
-
-- answers `400` to a malformed request, such as a broken header line or a
-  missing `Host`;
-- answers `405` to a method it does not pass on, such as `TRACE`;
-- answers `431` to a request line and headers over 32 KiB together;
-- gives the visitor 60 seconds to send the request line and headers, and then 60
-  seconds more for the whole request to reach the app;
-- answers `413` to a request body over 100 MiB;
-- gives the app's answer 30 minutes to reach the visitor, counted from the end
-  of the request;
-- answers `502` in place of an app's answer whose body is over 1 GiB, or cuts it
-  off if it has started;
-- closes a kept-open connection after 120 seconds idle.
-
-Together, `rproxy` and `waf` protect against:
 
 - Scrapers that fetch every page of a site, all day. Each client gets a limit on
   requests and on body bytes per minute, per hour and per day. The defaults