servewaf: each decision heuristic is its own module (closes #195)

Each check servewaf runs on a request is a type in its own file behind
one interface, heuristic, and is registered in one of four ordered lists
in heuristics.go. Order and behaviour are unchanged.

Every refusal now logs heuristic, the name of the heuristic that made
it, and heuristic_figures, the figures it acted on. A ban by
refusal_limit or byte_limits after the answer logs report_heuristic and
report_heuristic_figures instead, so a line can name both. All four are
in docs/request-log.md, and SPEC.md names each heuristic at its step.

Model: opus-5-5

internal/servewaf/coreruleset.go

@@ -1,6 +1,10 @@
 package servewaf
 
+// The heuristic core_rule_set. It reads SWWAF_WAF_MODE, SWWAF_WAF_EXEMPT_PATHS
+// and SWWAF_WAF_ANOMALY_THRESHOLD.
+
 import (
+	"context"
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
@@ -9,18 +13,21 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// checkCoreRuleSet inspects the request with the Core Rule Set, unless
+// coreRuleSet inspects the request with the Core Rule Set, unless
 // SWWAF_WAF_MODE is off or SWWAF_WAF_EXEMPT_PATHS exempts its path, as
 // pathExempt decides, and notes the rules it matched and its score in the
 // log line, and the rules in the metrics. A score at or over
 // SWWAF_WAF_ANOMALY_THRESHOLD is a match: it raises the waf_block alert,
-// and in block mode refuses the request, which is an offence its client's
-// history counts, and so returns ActionWAFBlocked. It returns "" for a
-// request it does not refuse.
-func (rq *request) checkCoreRuleSet() string {
+// and in block mode refuses the request with 403, which is an offence its
+// client's history counts. Its figures are the score and the threshold.
+type coreRuleSet struct{}
+
+func (coreRuleSet) name() string { return "core_rule_set" }
+
+func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	cfg := rq.h.config
 	if cfg.WAFMode == config.WAFModeOff || pathExempt(rq.in, cfg.WAFExemptPaths) {
-		return ""
+		return nil
 	}
 
 	start := time.Now()
@@ -40,18 +47,21 @@ func (rq *request) checkCoreRuleSet() string {
 
 	threshold := cfg.WAFAnomalyThreshold
 	if threshold == 0 || result.Score < threshold {
-		return ""
+		return nil
 	}
 
 	rq.alertWAFBlock(result)
 
 	if cfg.WAFMode == config.WAFModeDetect {
-		return ""
+		return nil
 	}
 
 	rq.wafBlocked = true
 
-	return requestlog.ActionWAFBlocked
+	return &verdict{
+		action:  requestlog.ActionWAFBlocked,
+		figures: map[string]any{figureScore: result.Score, "threshold": threshold},
+	}
 }
 
 // alertWAFBlock raises the waf_block alert for the request, which the Core