Ban notes name the reputation sources that listed the client (closes #109)

A ban's notes, in bans.json and in its alert, gain `reputation`: each
blocklist, DNSBL zone or AbuseIPDB that listed the client when the ban
was made, as its `source`, named and ordered as in the request log's
`reputation`, with AbuseIPDB's `score`. It is left out when none did.
README.md shows it in a bans.json example.

Notes now hold a list, so bans can no longer be compared with ==: the
tests compare them with reflect.DeepEqual.

Judgement call: the score is a pointer, so a score of 0, a hit while
SWWAF_ABUSEIPDB_MIN_SCORE is 0, is still written.

Model: opus-5-5

internal/proxy/reputation.go

@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
+	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 )
@@ -62,29 +63,34 @@ func (rq *request) abuseIPDBDenied(ctx context.Context) bool {
 	}
 
 	rq.abuseIPDBHit = true
-	rq.noteHit(reputation.AbuseIPDBSource, "scored by AbuseIPDB at or over "+
-		"SWWAF_ABUSEIPDB_MIN_SCORE", map[string]any{
-		"source": reputation.AbuseIPDBSource, "score": score,
-	})
+	rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
+		"scored by AbuseIPDB at or over SWWAF_ABUSEIPDB_MIN_SCORE")
 
 	return rq.h.config.ReputationAction == deny
 }
 
 // noteListed notes each of sources, the URLs of the blocklists or the
 // DNSBL zones, their keys masked, that list the client, as noteHit does,
-// with reason, and the source in the alert's detail.
+// with reason.
 func (rq *request) noteListed(sources []string, reason string) {
 	for _, source := range sources {
-		rq.noteHit(source, reason, map[string]any{"source": source})
+		rq.noteHit(bans.ReputationHit{Source: source}, reason)
 	}
 }
 
-// noteHit adds source, which lists the client, to the log line's
-// reputation, counts it in the metrics, and raises a reputation_hit alert
-// with reason and detail.
-func (rq *request) noteHit(source, reason string, detail map[string]any) {
-	rq.line.Reputation = append(rq.line.Reputation, source)
-	rq.h.metrics.ReputationHit(source)
+// noteHit adds hit's source, which lists the client, to the log line's
+// reputation, and hit to the notes of a ban the request makes, counts the
+// source in the metrics, and raises a reputation_hit alert with reason,
+// whose detail gives hit's source and score.
+func (rq *request) noteHit(hit bans.ReputationHit, reason string) {
+	detail := map[string]any{"source": hit.Source}
+	if hit.Score != nil {
+		detail["score"] = *hit.Score
+	}
+
+	rq.line.Reputation = append(rq.line.Reputation, hit.Source)
+	rq.reputation = append(rq.reputation, hit)
+	rq.h.metrics.ReputationHit(hit.Source)
 	rq.h.alerts.Raise(alerts.Alert{
 		Event:    alerts.EventReputationHit,
 		Client:   rq.client,