servewaf: each decision heuristic is its own module (closes #195)

Each check servewaf runs on a request is a type in its own file behind
one interface, heuristic, and is registered in one of four ordered lists
in heuristics.go. Order and behaviour are unchanged.

Every refusal now logs heuristic, the name of the heuristic that made
it, and heuristic_figures, the figures it acted on. A ban by
refusal_limit or byte_limits after the answer logs after_answer_heuristic
and after_answer_heuristic_figures instead, so a line can name both. All
four are in docs/request-log.md, and SPEC.md names each heuristic at its
step.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -131,6 +131,16 @@ type Line struct {
 	// ActionRuleBlocked, ActionWAFBlocked, or, in servewaf, ActionTooLarge
 	// for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
+	// Heuristic is the name of the heuristic that refused the request, in
+	// observe mode too, and HeuristicFigures are the figures it acted on, by
+	// name.
+	Heuristic        string         `json:"heuristic,omitempty"`
+	HeuristicFigures map[string]any `json:"heuristic_figures,omitempty"`
+	// AfterAnswerHeuristic and AfterAnswerHeuristicFigures are the same for
+	// the heuristic that banned the client after servewaf answered the
+	// request.
+	AfterAnswerHeuristic        string         `json:"after_answer_heuristic,omitempty"`
+	AfterAnswerHeuristicFigures map[string]any `json:"after_answer_heuristic_figures,omitempty"` //nolint:lll // a struct tag cannot be split
 	// LimitPercent and LimitPercentSetting are, for a request the rate
 	// limits counted whose client a biased threshold gives a percentage of
 	// the rate limits below 100, that percentage and the setting that gave