Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/discriminator/staticlists_test.go

@@ -32,7 +32,7 @@ func TestAllowNetsSkipEveryCheck(t *testing.T) {
 		trustedProxies:     trustLocalhost,
 		allowNets:          "198.51.100.0/24",
 		denyNets:           fromKP,
-		deniedCountries:    "kp",
+		tagDeny:            denyKP,
 		rateLimitPerMinute: "1",
 	})
 
@@ -83,9 +83,9 @@ func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
 	})
 	geojsURL, asked := startGeoJS(t)
 	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
-		trustedProxies:  trustLocalhost,
-		denyNets:        "203.0.113.0/24",
-		deniedCountries: "kp",
+		trustedProxies: trustLocalhost,
+		denyNets:       "203.0.113.0/24",
+		tagDeny:        denyKP,
 	})
 
 	req := newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body"))
@@ -142,7 +142,7 @@ func TestRateLimitExemptNetsAreNeitherCountedNorRefused(t *testing.T) {
 		trustedProxies:      trustLocalhost,
 		lookupTimeout:       "1h",
 		rateLimitExemptNets: listedAddr + "," + fromKP,
-		deniedCountries:     "kp",
+		tagDeny:             denyKP,
 		rateLimitPerMinute:  "1",
 	})
 
@@ -154,7 +154,7 @@ func TestRateLimitExemptNetsAreNeitherCountedNorRefused(t *testing.T) {
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
-		{fromKP, http.StatusForbidden, requestlog.ActionCountryDenied},
+		{fromKP, http.StatusForbidden, requestlog.ActionDenied},
 	})
 }