Add the public VPN server lists, with is_vpn and vpn_providers (closes #235)

The IP lookup now checks the public VPN server lists of Mullvad, NordVPN, Private Internet Access and IVPN, and X4BNet's community list, each downloaded once a day. `List` gains `VPN`. Every result gains `flags.is_vpn` and `vpn_providers`, which is empty when no list holds the address.

Judgement call: X4BNet's IPv4 and IPv6 files are two lists, `x4bnet` and `x4bnet_v6`, as Spamhaus's are.
Judgement call: Private Internet Access's signature is neither read nor checked.
Judgement call: a document with no addresses fails the parse.
Rule suppressed: `tagliatelle` on the structs holding the publishers' field names.

Model: opus-5-5

TODO.md

@@ -53,6 +53,10 @@ problem the run finds.
 
 # Completed Steps
 
+- 2026-11-10: the IP lookup checks the public VPN server lists of Mullvad,
+  NordVPN, Private Internet Access and IVPN, and X4BNet's community list. Each
+  result has `flags.is_vpn` and `vpn_providers` (closes
+  https://git.eeqj.de/sneak/routewatch/issues/235).
 - 2026-11-10: `tor_exits` comes from Onionoo, so it holds IPv6 exits and
   `is_tor` is true for them (closes
   https://git.eeqj.de/sneak/routewatch/issues/234).