Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

A request over a rate limit is refused with SWWAF_BAN_RESPONSE and bans
the client's netblock: an hour at first, three times the last ban when
broken again within a day of its end, permanent past seven days. The
ban ledger in internal/bans is checked after the static lists and
before the lookup, and the requests it refuses are not counted. A ban
resets the client's counters and carries notes holding the request
that broke the limit, as SPEC.md now says. At most SWWAF_MAX_BANS are
held. SWWAF_BAN_RESPONSE also answers SWWAF_DENY_NETS and the country
lists.

Judgement call: the six ban settings cannot be off.
Judgement call: a permanent ban's ban_expires is "permanent".

Model: opus-5-5

internal/proxy/export_test.go

@@ -0,0 +1,15 @@
+package proxy
+
+import (
+	"net/http"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+)
+
+// LedgerOf returns the ban ledger of a server New returned, so that the
+// tests can read the bans' notes.
+func LedgerOf(server *http.Server) *bans.Ledger {
+	h, _ := server.Handler.(*handler)
+
+	return h.ledger
+}