Add the ProtonVPN server networks and addresses to the IP lookup (closes #236)

Adds the VPN lists `protonvpn`, the servers' /24 networks, IPv4 only, and `protonvpn_entry`, the servers' IPv4 and IPv6 addresses. Each is downloaded once a day and shows in `flags.is_vpn` and `vpn_providers` with no other change.

Proton's `/vpn/logicals` answers 401 without a logged-in session, even with a current client's `x-pm-appversion`, so both come from the public ProtonVPN-IPs mirror. No request header is needed.

Judgement call: the mirror's /24 file as well as its exact addresses. Its README says traffic leaves from unpublished addresses in those networks. The cost is that neighbouring addresses are listed too.

Model: opus-5-5

internal/iplist/iplist.go

@@ -53,7 +53,8 @@ const (
 	FormatIVPNJSON
 
 	// FormatProtonVPN has one address or network per line, with comment lines
-	// that start with #. Unlike FormatLines, a file with no networks fails.
+	// that start with #. Unlike FormatLines, a file with no addresses or
+	// networks fails.
 	FormatProtonVPN
 )
 

internal/iplist/parse.go

@@ -331,8 +331,9 @@ func parseIVPN(r io.Reader) (*netipx.IPSet, error) {
 	return addressSet(texts)
 }
 
-// parseProtonVPN returns the networks in a ProtonVPN-IPs list. A file with no
-// networks fails, because the service always has servers.
+// parseProtonVPN returns the addresses or networks in a ProtonVPN-IPs list. A
+// file with no addresses or networks fails, because the service always has
+// servers.
 func parseProtonVPN(r io.Reader) (*netipx.IPSet, error) {
 	addresses, err := parseLines(r, addAddressOrNetwork)
 	if err != nil {