Add the ProtonVPN server networks and addresses to the IP lookup (closes #236)

Adds the VPN lists `protonvpn`, the servers' /24 networks, IPv4 only, and `protonvpn_entry`, the servers' IPv4 and IPv6 addresses. Each is downloaded once a day and shows in `flags.is_vpn` and `vpn_providers` with no other change.

Proton's `/vpn/logicals` answers 401 without a logged-in session, even with a current client's `x-pm-appversion`, so both come from the public ProtonVPN-IPs mirror. No request header is needed.

Judgement call: the mirror's /24 file as well as its exact addresses. Its README says traffic leaves from unpublished addresses in those networks. The cost is that neighbouring addresses are listed too.

Model: opus-5-5

README.md

@@ -435,10 +435,13 @@ The lists:
   [Private Internet Access](https://serverlist.piaservers.net/vpninfo/servers/v6),
   downloaded once a day.
 - `protonvpn`: the /24 networks that hold ProtonVPN servers. The whole /24 is
-  listed because ProtonVPN traffic can leave from an address Proton does not
-  publish. From the public
+  listed because the ProtonVPN-IPs README says traffic leaves from unpublished
+  addresses in it. From the public
   [ProtonVPN-IPs](https://github.com/tn3w/ProtonVPN-IPs) mirror of Proton's
   server list, downloaded once a day.
+- `protonvpn_entry`: the IPv4 and IPv6 addresses of ProtonVPN servers. From the
+  same [ProtonVPN-IPs](https://github.com/tn3w/ProtonVPN-IPs) mirror, downloaded
+  once a day.
 - `spamhaus_drop` and `spamhaus_dropv6`: IPv4 and IPv6 networks hijacked or
   leased by spammers or cyber criminals, according to Spamhaus. From
   [Spamhaus DROP](https://www.spamhaus.org/blocklists/do-not-route-or-peer/),

internal/iplist/iplist.go

@@ -52,8 +52,8 @@ const (
 	// and openvpn gateways have their addresses in host and v2ray.
 	FormatIVPNJSON
 
-	// FormatProtonVPN has one network per line, with comment lines that start
-	// with #. Unlike FormatLines, a file with no networks fails.
+	// FormatProtonVPN has one address or network per line, with comment lines
+	// that start with #. Unlike FormatLines, a file with no networks fails.
 	FormatProtonVPN
 )
 

internal/iplist/iplist_internal_test.go

@@ -76,6 +76,13 @@ const protonVPNBody = "#\n# protonvpn_ip_ranges.txt\n" +
 	"# The /24 block of every advertised IPv4.\n#\n" +
 	"192.0.2.0/24\n198.51.100.0/24\n"
 
+// protonVPNEntryBody is a small file in the format of the ProtonVPN-IPs list
+// of server addresses.
+const protonVPNEntryBody = "#\n# protonvpn_entry_ips.txt\n" +
+	"# https://github.com/tn3w/ProtonVPN-IPs\n#\n" +
+	"# Entry IPs clients connect to, resolved from ProtonVPN hostnames.\n#\n" +
+	"192.0.2.80\n2001:db8::80\n"
+
 // errorPage is a file that is no list, as a publisher's error page is.
 const errorPage = "<!DOCTYPE html>\n<html></html>\n"
 
@@ -280,6 +287,13 @@ func TestLookupFindsVPNServers(t *testing.T) {
 			listed:   []string{"192.0.2.0", "192.0.2.255", "198.51.100.7"},
 			unlisted: []string{"192.0.3.1", "2001:db8::90"},
 		},
+		{
+			name:     "ProtonVPN server addresses",
+			format:   FormatProtonVPN,
+			body:     protonVPNEntryBody,
+			listed:   []string{"192.0.2.80", "2001:db8::80"},
+			unlisted: []string{"192.0.2.81", "2001:db8::81"},
+		},
 	})
 }
 
@@ -562,7 +576,8 @@ func TestPublicListsMarkTheVPNLists(t *testing.T) {
 	}
 
 	want := []string{
-		"ivpn", "mullvad", "nordvpn", "pia", "protonvpn", "x4bnet", "x4bnet_v6",
+		"ivpn", "mullvad", "nordvpn", "pia", "protonvpn", "protonvpn_entry",
+		"x4bnet", "x4bnet_v6",
 	}
 	if !slices.Equal(got, want) {
 		t.Errorf("VPN lists %v, want %v", got, want)

internal/iplist/lists.go

@@ -161,6 +161,15 @@ func vpnLists() []List {
 			Format:   FormatProtonVPN,
 			VPN:      true,
 		},
+		{
+			Name:        "protonvpn_entry",
+			Description: "A server of the ProtonVPN service",
+			URL: "https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/" +
+				"protonvpn_entry_ips.txt",
+			Interval: vpnListInterval,
+			Format:   FormatProtonVPN,
+			VPN:      true,
+		},
 		{
 			Name: "x4bnet",
 			Description: "In an IPv4 network of a VPN service, according to " +