feat: chaitin waf response logging

[blaisewang]

Description

lua-resty-t1k 1.2.0 can report the response to the SafeLine WAF detection service in addition to the request. This PR bumps the dependency and exposes the capability through the chaitin-waf plugin.

Until now the plugin only reported requests, so anything the WAF could have detected on the way out — data leaks in a response body, a successful exploit's output, an unexpected status code — was invisible to SafeLine. Enabling response reporting closes that gap without changing how requests are handled.

Three new config options, available both at plugin level and in the plugin metadata:

Option	Type	Default	Description
log_resp	boolean	false	Report the response to the WAF service.
resp_body_size	integer (>= 0)	4	How much of the response body to report, in KB. 0 reports only the status line and headers.
extra_ignored_content_types	string	—	Comma separated response Content-Type values to skip, on top of the built-in list.

How it works:

• The plugin now implements the body_filter and log phases, delegating to t1k.do_body_filter() and t1k.do_log().
• body_filter buffers up to resp_body_size KB of the response body; the report itself is sent from an ngx.timer during the log phase, after the response has been handed back to the client. It therefore adds no latency to the response.
• The report is advisory only: detection results appear in the SafeLine console, and APISIX never blocks or modifies a response based on them. Request handling is unchanged.
• Responses are skipped when the request was already blocked, or when the response Content-Type is in the ignored list (audio, video, font, image and other binary media types out of the box).

One refactor was needed along the way: get_conf applied the metadata and plugin level config blocks with two verbatim copies of the same field-by-field assignment. Adding three more options would have meant keeping three copies in sync, so both are folded into a local helper. Precedence is unchanged — plugin level config still overrides metadata.

Docs updated in both en and zh, including a new "Response Logging" section that covers the async reporting model, the skip conditions, and the memory cost of buffering response bodies on routes serving large responses.

Which issue(s) this PR fixes:

N/A — no existing issue; this adds a new capability to the plugin.

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)