SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

gitea's fixes (its parameters, its cookies and gitea.conf) now apply
only to a hostname SWW_APPS lists gitea for, or to every hostname while
it is unset. Each app's fixes are one .conf file, whose first rule skips
the rest unless Inspect sets tx.app_<name>, and one entry in apps.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start.

Model: opus-5-5

SPEC.md

@@ -780,8 +780,8 @@ On a hostname that gets gitea's fixes, an app other than gitea must check these
 fields and cookies itself. Listing each hostname's own apps in `SWW_APPS` keeps
 the full check for the others.
 
-The parameter names in these changes and fixes are matched without regard to
+The parameter and cookie names in these changes and fixes are matched without
-case, and the cookie names exactly.
+regard to case, as Coraza matches them.
 
 ### Ban lengths, response and scope
 

internal/config/config.go

@@ -792,18 +792,15 @@ func (e *environment) pathPrefixes(name, defaultValue string) []string {
 }
 
 // apps reads the setting that is the apps each hostname serves. It is nil
-// while the setting is unset, and logged as null, unlike a setting set
+// while the setting is unset.
-// empty.
 func (e *environment) apps(name string) map[string][]string {
 	value, set := e.lookup(name)
-	if !set {
+	e.settings = append(e.settings, slog.String(name, value))
-		e.settings = append(e.settings, slog.Any(name, nil))
 
+	if !set {
 		return nil
 	}
 
-	e.settings = append(e.settings, slog.String(name, value))
-
 	apps, err := parseApps(value)
 	e.check(name, err)
 

internal/config/config_test.go

@@ -600,28 +600,6 @@ func TestApps(t *testing.T) {
 	}
 }
 
-// Unset and set empty, SWW_APPS has opposite effects, so it logs differently.
-func TestUnsetAndEmptyAppsAreLoggedDifferently(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		env  environment
-		want string
-	}{
-		{environment{}, `"` + apps + `":null`},
-		{environment{apps: ""}, `"` + apps + `":""`},
-	} {
-		var out bytes.Buffer
-
-		slog.New(slog.NewJSONHandler(&out, nil)).
-			Info("starting", "settings", fromEnvironment(t, tc.env))
-
-		if !strings.Contains(out.String(), tc.want) {
-			t.Errorf("%v logged %s, want %s in it", tc.env, out.String(), tc.want)
-		}
-	}
-}
-
 func TestInvalidAppsStopsTheStart(t *testing.T) {
 	t.Parallel()
 
@@ -2419,7 +2397,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		wafExemptPaths:       "",
 		wafBodyLimit:         off,
 		exclusionsFile:       "",
-		apps:                 "", // logged as null, which decodes as ""
+		apps:                 "",
 		trapPaths:            "",
 		errorBurstThreshold:  "30",
 		logRemoteURL:         "",