Add the public VPN server lists, with is_vpn and vpn_providers (closes #235)

The IP lookup now checks Mullvad, NordVPN, Private Internet Access, IVPN and X4BNet's community list, each downloaded once a day. Each result has `flags.is_vpn` and `vpn_providers`.

Judgement call: X4BNet publishes IPv4 and IPv6 as two files, so they are two lists, `x4bnet` and `x4bnet_v6`.
Judgement call: Private Internet Access's signature is not read or checked.
Rule suppressed: `tagliatelle` on the structs holding the publishers' field names.

Model: opus-5-5

TODO.md

@@ -53,6 +53,10 @@ problem the run finds.
 
 # Completed Steps
 
+- 2026-11-10: the IP lookup checks the public VPN server lists of Mullvad,
+  NordVPN, Private Internet Access and IVPN, and X4BNet's community list. Each
+  result has `flags.is_vpn` and `vpn_providers` (closes
+  https://git.eeqj.de/sneak/routewatch/issues/235).
 - 2026-11-10: `tor_exits` comes from Onionoo, so it holds IPv6 exits and
   `is_tor` is true for them (closes
   https://git.eeqj.de/sneak/routewatch/issues/234).