DNS blocklists asked in the background, verdicts kept (closes #104)

Zones in SWWAF_DNSBL_ZONES are asked about each client in the background,
through SWWAF_DNSBL_RESOLVER or the host's resolver; no request waits.
Verdicts last SWWAF_REPUTATION_CACHE_TTL, kept in reputation.json.
SWWAF_REPUTATION_ACTION (limit:25) denies, limits or logs a listed
client; each zone listing it raises reputation_hit. A failed query gives
no verdict, raises source_failure, and pauses the zone a minute. A
zone's key, its first label under dq.spamhaus.net, is masked everywhere
but reputation.json. Zones compare without regard to case.

Judgement call: answers in 127.255.255.0/24 or outside 127.0.0.0/8 are failures.
Judgement call: the minute's pause after a failure; at most 1,000 queries at once.
Judgement call: one zone given with two keys stops the start as listed twice.
Rule suppressed: paralleltest on the DNSBL tests (Go's resolver shares state across synctest bubbles), funlen on the test of every logged setting.

Model: opus-5-5

internal/reputation/reputation.go

@@ -2,8 +2,10 @@
 // blocklists of SWWAF_BLOCKLIST_URLS, and the file of AS:percent lines
 // SWWAF_ASN_LIMIT_PERCENT_URL names. It keeps the last good copy of each,
 // whole, comment lines included, which is used while a fetch fails, and
-// when each was last tried, which the state package writes to
-// reputation.json and reads from it, so that a restart keeps them too.
+// when each was last tried. It also asks the DNSBL zones of
+// SWWAF_DNSBL_ZONES about clients, and keeps their verdicts. The state
+// package writes all of these to reputation.json and reads them from it,
+// so that a restart keeps them too.
 package reputation
 
 import (