README: what rproxy gives an app without waf (closes #386)

Adds a paragraph to "What it does" listing what rproxy enforces with
default settings whether or not waf answers: malformed requests, methods,
header size, request and response times, body sizes, idle connections.
It says header count and line length limits are waf's.

Model: opus-5-5

README.md

@@ -22,8 +22,10 @@ shipped in one image, with two commands that do this together:
 The site keeps answering while `waf` is down, slow or restarting: without an
 answer in time, `rproxy` passes the request to the app.
 
-`rproxy` also protects the app on its own, whether or not `waf` answers. With
+`rproxy` also protects the app on its own, whether or not `waf` answers. It
-the default settings, `rproxy`:
+limits the total size of a request's headers, but not their number: the limits
+on the number of headers and cookies, and on each header line's length, are
+`waf`'s. With the default settings, `rproxy`:
 
 - answers `400` to a malformed request, such as a broken header line or a
   missing `Host`;
@@ -38,9 +40,6 @@ the default settings, `rproxy`:
   off if it has started;
 - closes a kept-open connection after 120 seconds idle.
 
-`rproxy` does not limit the number of headers. `waf` limits the number of
-headers and cookies, and the length of the request line and of each header line.
-
 Together, `rproxy` and `waf` protect against:
 
 - Scrapers that fetch every page of a site, all day. Each client gets a limit on
@@ -63,6 +62,8 @@ Together, `rproxy` and `waf` protect against:
       limit, so that they are banned sooner;
     - refuse or limit clients on a blocklist, a DNS blocklist, or with a high
       AbuseIPDB score.
+- Slow and oversized requests. Every request and every answer has a time limit
+  and a size limit.
 
 For the operator, it: