Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/discriminator/bans_test.go

@@ -211,7 +211,7 @@ func TestBannedClientIsRefusedBeforeItsCountryIsLookedUp(t *testing.T) {
 		lookupTimeout:      "1h",
 		rateLimitPerMinute: "1",
 		banScopeV4Prefix:   "24",
-		deniedCountries:    "kp",
+		tagDeny:            denyKP,
 	})
 
 	// fromDE's ban covers otherClient, which is refused unasked about.
@@ -266,7 +266,7 @@ func TestBanResponseAnswersEveryRefusalButTheSizeLimits(t *testing.T) {
 				lookupTimeout:      "1h",
 				rateLimitPerMinute: "1",
 				denyNets:           denied,
-				deniedCountries:    "kp",
+				tagDeny:            denyKP,
 			}
 
 			if tc.setting != "" {
@@ -276,7 +276,7 @@ func TestBanResponseAnswersEveryRefusalButTheSizeLimits(t *testing.T) {
 			s, _, _ := startWithClock(t, geojsURL, env)
 
 			s.get(denied, tc.status, requestlog.ActionDenied)
-			s.get(fromKP, tc.status, requestlog.ActionCountryDenied)
+			s.get(fromKP, tc.status, requestlog.ActionDenied)
 			s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 			s.get(fromDE, tc.status, requestlog.ActionRateLimited)
 			s.get(fromDE, tc.status, requestlog.ActionBanned)
@@ -291,7 +291,7 @@ func TestBanNotes(t *testing.T) {
 	s, clk, server := startWithClock(t, geojsURL, map[string]string{
 		lookupTimeout:      "1h",
 		rateLimitPerMinute: "1",
-		deniedCountries:    "kp",
+		tagDeny:            denyKP,
 	})
 	start := clk.Now()