Trap paths, and the error burst banning a client refused too often (closes #115)

SWWAF_TRAP_PATHS: a request whose path, as a path rule sees it, is one
of them is a clear sign of attack, banned as a ban rule's match is; the
ban's notes give its trap_path. Checked after the rate limits, before the
rule files.

SWWAF_ERROR_BURST_THRESHOLD (default 30, or off): more refusals in a
minute after a block or ban rule or a trap path, or for a missing or
wrong token, ban the client as a broken limit does. Counted in
clients.json's minute_refusals; limit_hit error_burst, notes kind
refusals.

A token refusal is now the offence token_refused, and
smallwebwaf_offences_total counts every kind the history does.

Judgement call: the threshold is not lowered by a client's limit percentage.

Model: opus-5-5

internal/proxy/admin.go

@@ -45,8 +45,9 @@ var (
 // /_smallwebwaf/, once it has passed the checks. Each endpoint needs a
 // token, sent as Authorization: Bearer <token>: the metrics
 // SWWAF_METRICS_TOKEN, the others SWWAF_ADMIN_TOKEN. A request without
-// it is refused with 401. An endpoint whose token is unset answers 404,
-// as any other request under /_smallwebwaf/ does.
+// it is refused with 401, which counts toward the error burst. An
+// endpoint whose token is unset answers 404, as any other request under
+// /_smallwebwaf/ does.
 func (rq *request) answerAdmin() {
 	rq.line.Action = requestlog.ActionAdmin
 	rq.startClientResponseTimeout()
@@ -57,6 +58,7 @@ func (rq *request) answerAdmin() {
 	case token == "":
 		http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
 	case !hasToken(rq.in, token):
+		rq.tokenRefused = true
 		rq.out.Header().Set("WWW-Authenticate", "Bearer")
 		rq.answer(refusal{
 			status: http.StatusUnauthorized,