waf: refuse request lines and header lines over 8 KiB first (closes #339)

The header limits now also refuse a request line over 8 KiB with 414
(action request_line_too_long) and a header line over 8 KiB, Host
included, with 431. Like the other header limits they are fixed, run
first and make no ban. One long query string or cookie no longer keeps
the Core Rule Set busy for a third of a second.

Model: opus-5-5

README.md

@@ -2,20 +2,7 @@
 
 `smallwebwaf` is an MIT-licensed web application firewall, written in Go by
 [@sneak](https://sneak.berlin), for self-hosted web apps. It refuses the
-requests of misbehaving scrapers, scanners and other abusers before they reach
-an app.
-
-With the default settings, a client is banned when it does any of these:
-
-- makes more than 120 requests in a minute, 1500 in an hour or 6000 in a day;
-- moves more than `50G` of request and response bodies in an hour, or `100G` in
-  a day;
-- asks for a secret or backup file, such as `/.env` or `/.git/config`;
-- sends a user agent that names a security scanner, such as `sqlmap` or `nikto`;
-- has more than 30 requests in a minute refused as probes or attacks.
-
-A scraper that does none of these is left alone. A scraper that waits 15 seconds
-between requests stays under the rate limits.
+requests of scrapers, scanners and other abusers before they reach an app.
 
 ## What it does