Remove the CrowdSec decision feed (closes #315)

sneak ruled to remove it. Gone: the heuristic crowdsec, the ban cause
crowdsec and its earlier_bans count, the tag crowdsec, the settings
SWW_WAF_CROWDSEC_LAPI_URL and SWW_WAF_CROWDSEC_LAPI_KEY, the decision
list fetch and parse in internal/reputation, their tests, and every
mention in the README, SPEC.md and docs/. EVALUATION.md keeps its
comparison of tools.

The ban ledger's internal ban function loses its expires parameter,
which only CrowdSec bans used.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

docs/alerts.md

@@ -13,9 +13,8 @@ back or dropped.
   threshold. The request was refused unless the alert's `detail` gives `mode`:
   `detect` or `observe`.
 - `anomaly`: a count over an anomaly threshold.
-- `reputation_hit`: a request from a client on a blocklist, the CrowdSec
-  decision list or a DNS blocklist, or with an AbuseIPDB score that is a hit.
-  One alert per source.
+- `reputation_hit`: a request from a client on a blocklist or a DNS blocklist,
+  or with an AbuseIPDB score that is a hit. One alert per source.
 - `source_failure`: one of:
     - GeoJS failing;
     - a list that cannot be fetched;
@@ -69,8 +68,7 @@ on one line:
             "earlier_bans": {
                 "limit": 0,
                 "attack": 0,
-                "admin": 0,
-                "crowdsec": 0
+                "admin": 0
             }
         }
     },