Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

docs/request-log.md

@@ -96,8 +96,8 @@ Every one of these lines has:
 
 - `action`: what was done:
     - `forward`: answered `allow`, so that `rproxy` passes it to the app;
-    - `denied`: refused for `SWW_DENY_NETS`, or for a reputation source with the
-      action `deny`;
+    - `denied`: refused for `SWW_DENY_NETS`, for a reputation source with the
+      action `deny`, or for a tag in `SWW_TAG_DENY`;
     - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
       CrowdSec decision, each of which bans the client;
     - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
@@ -115,6 +115,7 @@ Every one of these lines has:
     - `deny_nets`: `netblock`, the entry of `SWW_DENY_NETS` the client is in;
     - `active_ban`: `netblock`, the ban's netblock, and `ban_expires`;
     - `countries`: `country`, and `setting`, the country list that refused it;
+    - `tag_deny`: `tag`, the tag of `SWW_TAG_DENY` the request carries;
     - `blocklists`: `lists`, the blocklist URLs that list the client;
     - `crowdsec`: `scenario`, the decision's scenario, and `expires`, when the
       decision ends;
@@ -168,6 +169,8 @@ Every one of these lines has:
     - the CrowdSec decision list's URL;
     - DNS blocklist zones;
     - `abuseipdb`.
+- `tags`: the request's tags, sorted, left out when it has none. Each tag and
+  where it comes from is under "Request tags" in [`SPEC.md`](../SPEC.md).
 - `offence`: `limit`, for a request that broke a limit.
 - `ban_expires`: when the client's ban ends, for a request that made one or was
   refused under one: a time, or `permanent`.