Trap paths, and the error burst banning a client refused too often (closes #115)

SWWAF_TRAP_PATHS: a request whose path, as a path rule sees it, is one
of them is a clear sign of attack, banned as a ban rule's match is; the
ban's notes give its trap_path. Checked after the rate limits, before the
rule files.

SWWAF_ERROR_BURST_THRESHOLD (default 30, or off): more refusals in a
minute after a block or ban rule or a trap path, or for a missing or
wrong token, ban the client as a broken limit does. Counted in
clients.json's minute_refusals; limit_hit error_burst, notes kind
refusals.

A token refusal is now the offence token_refused, and
smallwebwaf_offences_total counts every kind the history does.

Judgement call: the threshold is not lowered by a client's limit percentage.

Model: opus-5-5

internal/ratelimit/ratelimit_test.go

@@ -248,6 +248,46 @@ func TestResetSetsTheBytesBackToZero(t *testing.T) {
 	wantBytesCount(t, limiter, client, start, 1000, "")
 }
 
+func TestRefusalsOverTheThresholdInAMinuteBreakTheErrorBurst(t *testing.T) {
+	t.Parallel()
+
+	limiter := ratelimit.New(ratelimit.Limits{}, tableSize)
+	client := netip.MustParsePrefix("203.0.113.9/32")
+	start := midnight()
+
+	for range limit {
+		if _, over := limiter.CountRefusal(client, start, limit); over {
+			t.Fatalf("a refusal within the threshold of %d broke the error burst", limit)
+		}
+	}
+
+	hit, over := limiter.CountRefusal(client, start, limit)
+
+	want := ratelimit.Hit{
+		Kind: ratelimit.KindRefusals, Window: minute, Limit: limit, Count: limit + 1,
+	}
+	if !over || hit != want {
+		t.Errorf("one over the threshold broke it: %t, with %+v; want %+v", over, hit,
+			want)
+	}
+
+	// Half a minute into the next, half of those four still count, 2, and
+	// this one: 3, within the threshold.
+	hit, over = limiter.CountRefusal(client, start.Add(time.Minute+time.Minute/2), limit)
+	if over || hit.Count != 3 {
+		t.Errorf("half a minute on, %v refusals broke it: %t; want 3, false",
+			hit.Count, over)
+	}
+
+	// A ban sets them back to zero.
+	limiter.Reset(client)
+
+	hit, _ = limiter.CountRefusal(client, start.Add(time.Minute+time.Minute/2), limit)
+	if hit.Count != 1 {
+		t.Errorf("after a reset, %v refusals, want 1", hit.Count)
+	}
+}
+
 func TestCountGivesTheRequestsInEachWindow(t *testing.T) {
 	t.Parallel()