discriminator: each decision heuristic is its own module (closes #195)

Each discriminator check is now a type in its own file behind one small interface, listed in `heuristics.go`. Adding a heuristic is one file and one line. Behaviour does not change.

Refusal and ban log lines gain `heuristic` and `heuristic_figures`. A ban after the answer, by `refusal_limit` or `byte_limits`, logs `after_answer_heuristic` and its figures, so one line can name both.

Deviation: four lists, not the planned three, so `refusal_limit` still bans at the decision.
Rule suppressed: `//nolint:lll` on one struct tag.

Model: opus-5-5

docs/request-log.md

@@ -108,6 +108,35 @@ Every one of these lines has:
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
   request it would have refused. `action` then names what was done, normally
   `forward`.
+- `heuristic`: the heuristic that refused the request, in `observe` mode too. It
+  is left out when none did.
+- `heuristic_figures`: an object of the figures that heuristic acted on. Each
+  heuristic and its figures:
+    - `deny_nets`: `netblock`, the entry of `SWW_DENY_NETS` the client is in;
+    - `active_ban`: `netblock`, the ban's netblock, and `ban_expires`;
+    - `countries`: `country`, and `setting`, the country list that refused it;
+    - `blocklists`: `lists`, the blocklist URLs that list the client;
+    - `crowdsec`: `scenario`, the decision's scenario, and `expires`, when the
+      decision ends;
+    - `dnsbl`: `zones`, the DNS blocklist zones that list the client, their keys
+      masked;
+    - `abuseipdb`: `score`, and `min_score`, `SWW_ABUSEIPDB_MIN_SCORE`;
+    - `rate_limits`: `window`, `count` and `limit`;
+    - `trap_paths`: `path`, the trap path asked for;
+    - `rule_files`: `rule_id` and `rule_action`, of the rule that refused it;
+    - `header_limits`: `fields`, `fields_limit`, `cookies` and `cookies_limit`;
+    - `core_rule_set`: `score`, and `threshold`, `SWW_WAF_ANOMALY_THRESHOLD`;
+    - `refusal_limit`: `window`, `count` and `limit`, of the error burst;
+    - `byte_limits`: `window`, `count` and `limit`, the count in bytes.
+- `after_answer_heuristic`: the heuristic that banned the client after
+  `discriminator` answered the request, in `observe` mode too: `refusal_limit`
+  or `byte_limits`.
+- `after_answer_heuristic_figures`: an object of the figures that heuristic
+  acted on, as listed above.
+
+    `byte_limits` bans when the report comes, so only the `report` line names
+    it.
+
 - `limit_percent` and `limit_percent_setting`: the client's percentage of the
   rate limits and the setting that lowered it, when one did. `bytes_percent` and
   `bytes_percent_setting` do the same for the byte limits.