Serve Prometheus metrics behind SWWAF_METRICS_TOKEN (closes #23)

GET /_smallwebwaf/metrics answers in the Prometheus text format for a
request carrying SWWAF_METRICS_TOKEN, 401 without it and 404 while it is
unset. Every request under /_smallwebwaf/ but the health check now goes
through the checks and is answered where it would be forwarded, 404 for
any path but the metrics, so none reaches the app. SWWAF_METRICS_TOP_N
bounds the series by country, the rest counted as other.

Judgement call: a request answered at smallwebwaf's own endpoints is
neither forwarded nor refused in the client's history.
Deviation: go.mod and go.sum written by hand from the module proxy and
sum.golang.org, as go runs only through make.
Deviation: no metrics yet for state files read again after an edit or
edits set aside; that work is not merged.

Model: opus-5-5

internal/proxy/history_test.go

@@ -86,6 +86,24 @@ func TestHealthEndpointIsNotInTheHistory(t *testing.T) {
 	}
 }
 
+func TestRequestForSmallwebwafIsNeitherForwardedNorRefused(t *testing.T) {
+	t.Parallel()
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
+	addr, out, server := startProxyWithClock(t, app.URL, "", time.Now,
+		map[string]string{metricsToken: token})
+
+	scrape(t, addr)
+	wantStatus(t, get(t, addr, "/_smallwebwaf/nothing"), http.StatusNotFound)
+	out.requestLines(t, 2)
+
+	history := historyOf(t, server, localhost)
+	if history.Requests != 2 || history.Forwarded != 0 || history.Refused != 0 {
+		t.Errorf("history counts %d requests, %d forwarded and %d refused, "+
+			"want 2, 0 and 0", history.Requests, history.Forwarded, history.Refused)
+	}
+}
+
 // historyOf returns the history of the client at addr.
 func historyOf(t *testing.T, server *proxy.Server, addr string) ratelimit.History {
 	t.Helper()