SWW_APPS: an app's Core Rule Set fixes apply only to the hostnames that serve it (closes #220)

gitea's fixes (its parameters, its cookies and gitea.conf) now apply
only to a hostname SWW_APPS lists gitea for, or to every hostname while
it is unset. Each app's fixes are one .conf file, whose first rule skips
the rest unless Inspect sets tx.app_<name>, and one entry in apps.

A hostname in SWW_APPS that is not a DNS name, such as *.example.com,
stops the start. Unset, SWW_APPS is logged at start as null; set
empty, as "".

Model: opus-5-5

SPEC.md

@@ -780,8 +780,8 @@ On a hostname that gets gitea's fixes, an app other than gitea must check these
 fields and cookies itself. Listing each hostname's own apps in `SWW_APPS` keeps
 the full check for the others.
 
-The parameter and cookie names in these changes and fixes are matched without
+The parameter names in these changes and fixes are matched without regard to
-regard to case, as Coraza matches them.
+case, and the cookie names exactly.
 
 ### Ban lengths, response and scope
 

internal/config/config.go

@@ -792,15 +792,18 @@ func (e *environment) pathPrefixes(name, defaultValue string) []string {
 }
 
 // apps reads the setting that is the apps each hostname serves. It is nil
-// while the setting is unset.
+// while the setting is unset, and logged as null, unlike a setting set
+// empty.
 func (e *environment) apps(name string) map[string][]string {
 	value, set := e.lookup(name)
-	e.settings = append(e.settings, slog.String(name, value))
-
 	if !set {
+		e.settings = append(e.settings, slog.Any(name, nil))
+
 		return nil
 	}
 
+	e.settings = append(e.settings, slog.String(name, value))
+
 	apps, err := parseApps(value)
 	e.check(name, err)
 

internal/config/config_test.go

@@ -600,6 +600,28 @@ func TestApps(t *testing.T) {
 	}
 }
 
+// Unset and set empty, SWW_APPS has opposite effects, so it logs differently.
+func TestUnsetAndEmptyAppsAreLoggedDifferently(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		env  environment
+		want string
+	}{
+		{environment{}, `"` + apps + `":null`},
+		{environment{apps: ""}, `"` + apps + `":""`},
+	} {
+		var out bytes.Buffer
+
+		slog.New(slog.NewJSONHandler(&out, nil)).
+			Info("starting", "settings", fromEnvironment(t, tc.env))
+
+		if !strings.Contains(out.String(), tc.want) {
+			t.Errorf("%v logged %s, want %s in it", tc.env, out.String(), tc.want)
+		}
+	}
+}
+
 func TestInvalidAppsStopsTheStart(t *testing.T) {
 	t.Parallel()
 
@@ -2397,7 +2419,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		wafExemptPaths:       "",
 		wafBodyLimit:         off,
 		exclusionsFile:       "",
-		apps:                 "",
+		apps:                 "", // logged as null, which decodes as ""
 		trapPaths:            "",
 		errorBurstThreshold:  "30",
 		logRemoteURL:         "",