AS number and country looked up for every client (closes #95)

GeoJS's geo.json is asked about every new visitor unless
SWWAF_LOOKUP_SOURCE is off. A request waits for its client's first
answer only while a country list or SWWAF_ADD_LOOKUP_HEADERS needs it;
otherwise the answer reaches the client's history and ban notes when it
comes. The AS number and name go beside the country in the request log,
history, ban notes, alerts and lookups.json, with metrics by AS number;
64512 counts as unknown. A client's own X-Client-ASN and
X-Client-Country never reach the app, whatever the setting says, and
make example-app sends no address to GeoJS.

Judgement call: AS numbers are written AS64496, as SPEC's settings write them.
Judgement call: SWWAF_LOOKUP_TIMEOUT is added, default 1s, and cannot be off.

Model: opus-5-5

internal/proxy/countries.go

@@ -1,31 +1,17 @@
 package proxy
 
 import (
-	"context"
-	"net/netip"
 	"slices"
 )
 
-// countryDenied reports whether the country lists refuse the request.
-// The client's country is looked up only while a list is set, and never
-// for a client on a private, loopback or link-local address, which has
-// no country. A client without a country, or whose country cannot be
-// found, is refused only by SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES. ctx is
-// the request's own context.
-func (rq *request) countryDenied(ctx context.Context) bool {
+// countryDenied reports whether the country lists refuse the request, by
+// the client's country as it was looked up. A client without a country,
+// or whose country cannot be found, is refused only by
+// SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES.
+func (rq *request) countryDenied() bool {
 	denied := rq.h.config.DeniedCountries
 	allowed := rq.h.config.ExclusivelyAllowedCountries
-
-	if len(denied) == 0 && len(allowed) == 0 {
-		return false
-	}
-
-	var country string
-	if hasCountry(rq.client) {
-		country = rq.h.geojs.Country(ctx, clientGroup(rq.client))
-	}
-
-	rq.line.Country = country
+	country := rq.line.Country
 
 	if slices.Contains(denied, country) {
 		return true
@@ -33,9 +19,3 @@ func (rq *request) countryDenied(ctx context.Context) bool {
 
 	return len(allowed) > 0 && !slices.Contains(allowed, country)
 }
-
-// hasCountry reports whether addr can be placed in a country: private,
-// loopback and link-local addresses cannot.
-func hasCountry(addr netip.Addr) bool {
-	return !addr.IsPrivate() && !addr.IsLoopback() && !addr.IsLinkLocalUnicast()
-}