AS number and country looked up for every client (closes #95)

GeoJS's geo.json is asked about every new visitor unless
SWWAF_LOOKUP_SOURCE is off. A request waits for its client's first
answer only while a country list or SWWAF_ADD_LOOKUP_HEADERS needs it;
otherwise the answer reaches the client's history and ban notes when it
comes. The AS number and name go beside the country in the request log,
history, ban notes, alerts and lookups.json, with metrics by AS number;
64512 counts as unknown. A client's own X-Client-ASN and
X-Client-Country never reach the app, whatever the setting says, and
make example-app sends no address to GeoJS.

Judgement call: AS numbers are written AS64496, as SPEC's settings write them.
Judgement call: SWWAF_LOOKUP_TIMEOUT is added, default 1s, and cannot be off.

Model: opus-5-5

script/example-app

@@ -7,9 +7,10 @@
 # request bans for good, that `sv stop` stops smallwebwaf in order, that
 # `docker stop` stops the container without having to kill it, and that
 # a new container on the same volume still refuses the banned client. The
-# containers, the volume and both images are removed however the script
-# ends. Building the app needs network access, for nixpkgs' binary cache.
-# script/check does not run this.
+# containers run with SWWAF_LOOKUP_SOURCE=off, so that no address is sent
+# to GeoJS. The containers, the volume and both images are removed however
+# the script ends. Building the app needs network access, for nixpkgs'
+# binary cache. script/check does not run this.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -63,12 +64,13 @@ logged() {
 }
 
 # start_container: run the app's container, with the state files on the
-# volume and a rate limit of one request a minute, and wait until it is
-# healthy.
+# volume, a rate limit of one request a minute and no client looked up,
+# and wait until it is healthy.
 start_container() {
     docker run --detach --name "$CONTAINER" --publish 127.0.0.1::8080 \
         --volume "$VOLUME:/var/lib/smallwebwaf" \
         --env SWWAF_RATE_LIMIT_PER_MINUTE=1 \
+        --env SWWAF_LOOKUP_SOURCE=off \
         "$APP_IMAGE" >/dev/null
     wait_for "the health check did not pass" healthy
     address="$(docker port "$CONTAINER" 8080/tcp)"