servewaf: each decision heuristic is its own module (closes #195)

Each check servewaf runs on a request is a type in its own file behind
one interface, heuristic, and is registered in one of four ordered lists
in heuristics.go. Order and behaviour are unchanged.

Every refusal now logs heuristic, the name of the heuristic that made
it, and heuristic_figures, the figures it acted on. A ban by
refusal_limit or byte_limits after the answer logs report_heuristic and
report_heuristic_figures instead, so a line can name both. All four are
in docs/request-log.md, and SPEC.md names each heuristic at its step.

Model: opus-5-5

docs/request-log.md

@@ -107,6 +107,34 @@ Every one of these lines has:
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
   request it would have refused. `action` then names what was done, normally
   `forward`.
+- `heuristic`: the heuristic that refused the request, in `observe` mode too. It
+  is left out when none did.
+- `heuristic_figures`: an object of the figures that heuristic acted on. Each
+  heuristic and its figures:
+    - `deny_nets`: `netblock`, the entry of `SWWAF_DENY_NETS` the client is in;
+    - `active_ban`: `netblock`, the ban's netblock, and `ban_expires`;
+    - `countries`: `country`, and `setting`, the country list that refused it;
+    - `blocklists`: `lists`, the blocklist URLs that list the client;
+    - `crowdsec`: `scenario`, the decision's scenario, and `expires`, when the
+      decision ends;
+    - `dnsbl`: `zones`, the DNS blocklist zones that list the client, their keys
+      masked;
+    - `abuseipdb`: `score`, and `min_score`, `SWWAF_ABUSEIPDB_MIN_SCORE`;
+    - `rate_limits`: `window`, `count` and `limit`;
+    - `trap_paths`: `path`, the trap path asked for;
+    - `rule_files`: `rule_id` and `rule_action`, of the rule that refused it;
+    - `header_limits`: `fields`, `fields_limit`, `cookies` and `cookies_limit`;
+    - `core_rule_set`: `score`, and `threshold`, `SWWAF_WAF_ANOMALY_THRESHOLD`;
+    - `refusal_limit`: `window`, `count` and `limit`, of the error burst;
+    - `byte_limits`: `window`, `count` and `limit`, the count in bytes.
+- `report_heuristic`: the heuristic that banned the client after `servewaf`
+  answered the request, in `observe` mode too: `refusal_limit` or `byte_limits`.
+- `report_heuristic_figures`: an object of the figures that heuristic acted on,
+  as listed above.
+
+    `byte_limits` bans when the report comes, so only the `report` line names
+    it.
+
 - `limit_percent` and `limit_percent_setting`: the client's percentage of the
   rate limits and the setting that lowered it, when one did. `bytes_percent` and
   `bytes_percent_setting` do the same for the byte limits.