Remove the CrowdSec decision feed (closes #315)

sneak ruled to remove it. Gone: the heuristic crowdsec, the ban cause
crowdsec and its earlier_bans count, the tag crowdsec, the settings
SWW_WAF_CROWDSEC_LAPI_URL and SWW_WAF_CROWDSEC_LAPI_KEY, the decision
list fetch and parse in internal/reputation, their tests, and every
mention in the README, SPEC.md and docs/. EVALUATION.md keeps its
comparison of tools.

The ban ledger's internal ban function loses its expires parameter,
which only CrowdSec bans used.

Model: opus-5-5
Co-authored-by: clawbot <sneak+clawbot@sneak.cloud>

docs/settings.md

@@ -180,8 +180,8 @@ in [`SPEC.md`](../SPEC.md).
   `name=URL` pairs, such as `torexit=https://example.com/tor.txt`. A name is the
   tag, and may hold `=`, such as `vpn=mullvad`. Each list is an `http` or
   `https` URL fetched like a blocklist. A name or URL listed twice is refused.
-  So is a URL that is also in `SWW_WAF_BLOCKLIST_URLS`,
-  `SWW_WAF_ASN_LIMIT_PERCENT_URL`, or the CrowdSec decision list.
+  So is a URL that is also in `SWW_WAF_BLOCKLIST_URLS` or is
+  `SWW_WAF_ASN_LIMIT_PERCENT_URL`.
 - `SWW_WAF_TAG_DENY` (default empty): tags whose requests are refused, such as
   `torexit,country=CN`. A tag listed twice, an `asn=` tag without a number, or a
   `country=` tag without a country, is refused.
@@ -214,9 +214,6 @@ tag that no request can get stops the start. A request can get only these:
   `SWW_WAF_CORE_RULE_SET_MODE` nor `SWW_WAF_CORE_RULE_SET_SCORE_THRESHOLD` is
   `off`.
 
-`crowdsec` stops the start in both settings, because a CrowdSec decision refuses
-the request first.
-
 ## Biased thresholds
 
 - `SWW_WAF_ASN_BYTES_LIMIT_PERCENT` and `SWW_WAF_COUNTRY_BYTES_LIMIT_PERCENT`
@@ -333,14 +330,6 @@ the request first.
   score, from 0 to 100, that is a hit.
 - `SWW_WAF_ABUSEIPDB_DAILY_BUDGET` (default `900`): the most checks made in a
   day, a whole number above zero. AbuseIPDB's free accounts may make 1,000.
-- `SWW_WAF_CROWDSEC_LAPI_URL` (default unset): the local API of a CrowdSec
-  engine you run, such as `http://172.17.0.1:8080`. An `http` or `https` URL
-  without a user or a fragment; its decision list is at `v1/decisions` under it.
-  Set without the key, it is refused. So is a decision list URL that is also in
-  `SWW_WAF_BLOCKLIST_URLS`, or that is `SWW_WAF_ASN_LIMIT_PERCENT_URL`.
-- `SWW_WAF_CROWDSEC_LAPI_KEY` (default unset): the key the engine gave for
-  `smallwebwaf`, as `cscli bouncers add smallwebwaf` prints it. Set without the
-  URL, it is refused.
 - `SWW_WAF_DNSBL_ABUSEIPDB_ACTION` (default `limit:25`): `deny`,
   `limit:<percent>` or `log`, for DNS blocklist and AbuseIPDB hits.
 - `SWW_WAF_IP_REPUTATION_CACHE_TTL` (default `24h`): how long a zone's verdict