Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

A request over a rate limit is refused with SWWAF_BAN_RESPONSE and bans
the client's netblock: an hour at first, three times the last ban when
broken again within a day of its end, permanent past seven days. The
ban ledger in internal/bans is checked after the static lists and
before the lookup, and the requests it refuses are not counted. A ban
resets the client's counters and carries notes holding the request
that broke the limit, as SPEC.md now says. At most SWWAF_MAX_BANS are
held. SWWAF_BAN_RESPONSE also answers SWWAF_DENY_NETS and the country
lists.

Judgement call: the six ban settings cannot be off.
Judgement call: a permanent ban's ban_expires is "permanent".

Model: opus-5-5

internal/proxy/ratelimits_test.go

@@ -8,7 +8,11 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-func TestRateLimitRefusesWith429BeforeTheApp(t *testing.T) {
+// minute is the window of SWWAF_RATE_LIMIT_PER_MINUTE, as a log line's
+// limit_hit names it.
+const minute = "minute"
+
+func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 	t.Parallel()
 
 	var calls atomic.Int32
@@ -24,19 +28,19 @@ func TestRateLimitRefusesWith429BeforeTheApp(t *testing.T) {
 	const otherClient = "203.0.113.10"
 
 	// With a limit of one request a minute, a client's second request is
-	// refused. A client is one IPv4 address, or one IPv6 /64; an IPv4
-	// address in IPv6 form is that IPv4 address.
+	// refused, with 403 by default. A client is one IPv4 address, or one
+	// IPv6 /64; an IPv4 address in IPv6 form is that IPv4 address.
 	requests := []struct {
 		client string // as X-Forwarded-For names it
 		logged string // as the log line's client_ip names it
 		want   int
 	}{
 		{client, client, http.StatusOK},
-		{client, client, http.StatusTooManyRequests},
+		{client, client, http.StatusForbidden},
 		{otherClient, otherClient, http.StatusOK},
-		{"::ffff:" + otherClient, otherClient, http.StatusTooManyRequests},
+		{"::ffff:" + otherClient, otherClient, http.StatusForbidden},
 		{"2001:db8::1", "2001:db8::1", http.StatusOK},
-		{"2001:db8::8000:0:0:1", "2001:db8::8000:0:0:1", http.StatusTooManyRequests},
+		{"2001:db8::8000:0:0:1", "2001:db8::8000:0:0:1", http.StatusForbidden},
 		{"2001:db8:0:1::1", "2001:db8:0:1::1", http.StatusOK},
 	}
 
@@ -53,9 +57,9 @@ func TestRateLimitRefusesWith429BeforeTheApp(t *testing.T) {
 		if sent.want == http.StatusOK {
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 		} else {
-			wantLine(t, line, http.StatusTooManyRequests, requestlog.ActionRateLimited)
+			wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
 
-			if line.LimitHit != "minute" {
+			if line.LimitHit != minute {
 				t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
 			}
 		}