Remove the CrowdSec decision feed (closes #315)

sneak ruled to remove it. Gone: the heuristic crowdsec, the ban cause
crowdsec and its earlier_bans count, the tag crowdsec, the settings
SWW_WAF_CROWDSEC_LAPI_URL and SWW_WAF_CROWDSEC_LAPI_KEY, the decision
list fetch and parse in internal/reputation, their tests, and every
mention in the README, SPEC.md and docs/. EVALUATION.md keeps its
comparison of tools.

The ban ledger's internal ban function loses its expires parameter,
which only CrowdSec bans used.

Model: opus-5-5

internal/metrics/metrics.go

@@ -185,7 +185,7 @@ func (m *Metrics) AddBansAndClients(
 	ledger *bans.Ledger, limiter *ratelimit.Limiter, now func() time.Time,
 ) {
 	for _, cause := range []string{
-		bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin, bans.CauseCrowdSec,
+		bans.CauseLimit, bans.CauseAttack, bans.CauseAdmin,
 	} {
 		m.registry.MustRegister(
 			prometheus.NewCounterFunc(prometheus.CounterOpts{
@@ -302,20 +302,20 @@ const sourceLabel = "source"
 
 // AddReputation adds the metrics of the lists fetched from URLs and of the
 // DNSBL zones, by source, each list's URL or each zone, its key masked as
-// config.MaskZoneKey masks it: the requests whose client a blocklist, the
-// CrowdSec decision list, a zone's verdict or AbuseIPDB's score lists,
-// which ReputationHit counts, and, read from lists and dnsbl as the
-// metrics are asked for, for a list, the fetches that failed and when the
-// copy in use was fetched, and for a zone, the queries made and those that
-// failed. It is called once, before ReputationHit.
+// config.MaskZoneKey masks it: the requests whose client a blocklist, a
+// zone's verdict or AbuseIPDB's score lists, which ReputationHit counts,
+// and, read from lists and dnsbl as the metrics are asked for, for a list,
+// the fetches that failed and when the copy in use was fetched, and for a
+// zone, the queries made and those that failed. It is called once, before
+// ReputationHit.
 func (m *Metrics) AddReputation(
 	lists *reputation.Lists,
 	dnsbl *reputation.DNSBL,
 ) {
 	m.reputationHits = counterVec(
 		"sww_reputation_hits_total",
-		"Requests whose client a blocklist, the CrowdSec decision list, a DNSBL "+
-			"zone or AbuseIPDB lists, by the list's URL, the zone, or abuseipdb.",
+		"Requests whose client a blocklist, a DNSBL zone or AbuseIPDB lists, "+
+			"by the list's URL, the zone, or abuseipdb.",
 		[]string{sourceLabel},
 	)
 	m.registry.MustRegister(m.reputationHits)
@@ -378,9 +378,8 @@ func (m *Metrics) AddAbuseIPDB(abuseIPDB *reputation.AbuseIPDB) {
 	)
 }
 
-// ReputationHit counts a request whose client source lists: a blocklist
-// or the CrowdSec decision list, by its URL, a DNSBL zone, its key masked,
-// or AbuseIPDB, abuseipdb.
+// ReputationHit counts a request whose client source lists: a blocklist,
+// by its URL, a DNSBL zone, its key masked, or AbuseIPDB, abuseipdb.
 func (m *Metrics) ReputationHit(source string) {
 	m.reputationHits.WithLabelValues(source).Inc()
 }