README and SPEC say a client too slow to send its request line and headers may get 400 (closes #138)

A client too slow to send its request line and headers within
SWWAF_CLIENT_REQUEST_TIMEOUT gets either no answer or, depending on how
much of them had arrived, 400 Bad Request from Go's server; either way
its connection is closed, nothing reaches the app, and no request log
line is written. The README's "Request log" and SPEC's size and time
limits said such a client always gets no answer. Both documents'
summaries of answers gave 408 for any slow client, when it is only for
a slow body.

Model: opus-5-5

README.md

@@ -110,16 +110,16 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set, and the default rule file of
   `X-Forwarded-Proto`, and `X-Forwarded-For` with the peer added at the end. It
   also gets the request's id in `X-Request-ID`, the same id as in the request's
   log line (see `request_id` in "Request log" below).
-- Enforces the timeouts and the size limits below. Once a request's line and
+- Enforces the timeouts and the size limits below. A limit passed before the
-  headers have been read, a limit passed before the response has started gets
+  response has started gets `smallwebwaf`'s own answer: `408` for a client too
-  `smallwebwaf`'s own answer: `408` for a client too slow to send its body,
+  slow to send its body, `413` for a request body that is too large, `504` for
-  `413` for a request body that is too large, `504` for an app too slow to
+  an app too slow to answer, and `502` for a response that is too large or an
-  answer, and `502` for a response that is too large or an app that cannot be
+  app that cannot be reached. A request that announces a body over the limit is
-  reached. A request that announces a body over the limit is refused before
+  refused before anything reaches the app. While a request body is still on its
-  anything reaches the app. While a request body is still on its way, a request
+  way, a request timeout that runs out answers `408` if `smallwebwaf` was
-  timeout that runs out answers `408` if `smallwebwaf` was waiting for the
+  waiting for the client to send more, and `504` if it was waiting for the app
-  client to send more, and `504` if it was waiting for the app to take what it
+  to take what it had. Once the response has started, a limit can only cut the
-  had. Once the response has started, a limit can only cut the connection.
+  connection.
 - Counts each client's requests over a minute, an hour and a day. A request that
   takes the client over one of the rate limits below is refused with
   `SWWAF_BAN_RESPONSE`, `403` by default, before anything reaches the app, and

SPEC.md

@@ -414,10 +414,10 @@ The settings, by group:
       to send its request line and headers, and then, from the end of the
       headers, its body.
     - `SWWAF_CLIENT_REQUEST_HEADER_MAX_BYTES` (default `32K`): the largest
-      request line and headers a client may send. Over it, Go's HTTP server
+      request line and headers a client may send. Over it, `smallwebwaf` answers
-      answers `431` and closes the connection, and nothing reaches the app. It
+      `431` and closes the connection, and nothing reaches the app. It must be
-      must be more than `4K`, and cannot be `off`: Go's HTTP server always has
+      more than `4K`, and cannot be `off`: Go's HTTP server always has such a
-      such a limit, and reads 4 KiB past the one it is given before it refuses.
+      limit, and reads 4 KiB past the one it is given before it refuses.
     - `SWWAF_CLIENT_IDLE_TIMEOUT` (default `120s`): how long a kept-open
       connection may wait for its next request before `smallwebwaf` closes it.
       It is longer than the 90 seconds after which traefik, by default, closes a
@@ -435,13 +435,12 @@ The settings, by group:
       the client sends it and the app receives it.
     - `SWWAF_RESPONSE_MAX_BYTES` (default `5G`): the largest response body, as
       the app sends it and the client receives it.
-    - When a limit is passed after a request's line and headers have been read,
+    - When a limit is passed before the response has started, `smallwebwaf`
-      but before the response has started, `smallwebwaf` answers itself: `413`
+      answers itself: `413` for a request body that is too large, `408` for a
-      for a request body that is too large, `408` for a client too slow to send
+      client too slow to send its body, `502` for a response that is too large,
-      its body, `502` for a response that is too large, `504` for an app that is
+      `504` for an app that is too slow. A request that announces a body larger
-      too slow. A request that announces a body larger than its limit is refused
+      than its limit is refused before anything reaches the app. Once the
-      before anything reaches the app. Once the response has started it can only
+      response has started it can only be cut off, and the connection is closed.
-      be cut off, and the connection is closed.
     - Since a request body streams through, each side can hold up the other: a
       slow client slows the send to the app, and an app slow to take the body
       slows the client's send. So while a request body is still on its way, a