Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

A request over a rate limit is refused with SWWAF_BAN_RESPONSE and bans
the client's netblock: an hour at first, three times the last ban when
broken again within a day of its end, permanent past seven days. The
ban ledger in internal/bans is checked after the static lists and
before the lookup, and the requests it refuses are not counted. A ban
resets the client's counters and carries notes holding the request
that broke the limit, as SPEC.md now says. At most SWWAF_MAX_BANS are
held. SWWAF_BAN_RESPONSE also answers SWWAF_DENY_NETS and the country
lists.

Judgement call: the six ban settings cannot be off.
Judgement call: a permanent ban's ban_expires is "permanent".

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -24,8 +24,10 @@ const (
 	// for, or whose answer could not be passed on.
 	ActionUpstreamError = "upstream_error"
 	// ActionRateLimited is a request refused because it took its client
-	// over a rate limit, or came while the client was over one.
+	// over a rate limit, which bans the client.
 	ActionRateLimited = "rate_limited"
+	// ActionBanned is a request refused because a ban covers its client.
+	ActionBanned = "banned"
 	// ActionDenied is a request refused because its client is in
 	// SWWAF_DENY_NETS.
 	ActionDenied = "denied"
@@ -36,6 +38,10 @@ const (
 	ActionAdmin = "admin"
 )
 
+// OffenceLimit is the offence a request line names for a request that
+// broke a rate limit.
+const OffenceLimit = "limit"
+
 // timeLayout is RFC 3339 with milliseconds.
 const timeLayout = "2006-01-02T15:04:05.000Z07:00"
 
@@ -64,6 +70,11 @@ type Line struct {
 	// LimitHit is the window whose rate limit the request went over:
 	// minute, hour or day.
 	LimitHit string `json:"limit_hit,omitempty"`
+	// Offence is the offence the request was held as, OffenceLimit.
+	Offence string `json:"offence,omitempty"`
+	// BanExpires is when the ban the request made, or was refused under,
+	// ends: a time, or "permanent".
+	BanExpires string `json:"ban_expires,omitempty"`
 	// Aborted is true when the client went away early.
 	Aborted bool `json:"aborted,omitempty"`
 	// DurationTotal and DurationUpstreamTotal are in milliseconds.

internal/requestlog/requestlog_test.go

@@ -50,7 +50,8 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	}
 
 	unset := []string{
-		"upstream_status", "limit_hit", "aborted", "duration_upstream_total",
+		"upstream_status", "limit_hit", "offence", "ban_expires", "aborted",
+		"duration_upstream_total",
 	}
 	for _, name := range unset {
 		_, present := fields[name]