Add the ProtonVPN server networks to the IP lookup (closes #236)

Adds the VPN list `protonvpn`, downloaded once a day. It shows in `flags.is_vpn` and `vpn_providers` with no other change.

Proton's `/vpn/logicals` answers 401 without a logged-in session, even with a current client's `x-pm-appversion`, so the list comes from the public ProtonVPN-IPs mirror. No request header is needed.

Judgement call: the mirror's /24 file, not its exact addresses. Its README says traffic leaves from unpublished addresses in those networks. The cost is that neighbouring addresses are listed too.

Model: opus-5-5

README.md

@@ -434,6 +434,11 @@ The lists:
 - `pia`: VPN servers run by Private Internet Access. From
   [Private Internet Access](https://serverlist.piaservers.net/vpninfo/servers/v6),
   downloaded once a day.
+- `protonvpn`: the /24 networks that hold ProtonVPN servers. The whole /24 is
+  listed because ProtonVPN traffic can leave from an address Proton does not
+  publish. From the public
+  [ProtonVPN-IPs](https://github.com/tn3w/ProtonVPN-IPs) mirror of Proton's
+  server list, downloaded once a day.
 - `spamhaus_drop` and `spamhaus_dropv6`: IPv4 and IPv6 networks hijacked or
   leased by spammers or cyber criminals, according to Spamhaus. From
   [Spamhaus DROP](https://www.spamhaus.org/blocklists/do-not-route-or-peer/),