CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

SWWAF_CROWDSEC_LAPI_URL and SWWAF_CROWDSEC_LAPI_KEY name an engine whose
decision list, <url>/v1/decisions, is fetched every minute with the key in
X-Api-Key, following no redirect, and kept as a blocklist is: used while a
fetch fails, and across restarts through reputation.json. Ban decisions on an
Ip or a Range end at the fetch time plus their duration. A listed client's
request is refused and bans its netblock with the cause crowdsec until the
decision ends; bans.json, ban notes and metrics take the cause.

Judgement call: fetched every minute, not a setting.
Judgement call: a crowdsec ban never lengthens a limit ban.
Judgement call: a lifted crowdsec ban is remade while its decision lasts.

Model: opus-5-5

internal/proxy/proxy.go

@@ -74,9 +74,10 @@ type Params struct {
 	Rules *rules.Files
 	// Alerts receive the alert for each ban the proxy makes or makes
 	// permanent, for each count over an anomaly threshold, for each request
-	// whose client a blocklist, a DNSBL zone or AbuseIPDB lists, and for
-	// GeoJS failing, a fetch of a list failing, a query to a DNSBL zone or
-	// a check with AbuseIPDB failing, or the day's AbuseIPDB checks used up.
+	// whose client a blocklist, the CrowdSec decision list, a DNSBL zone or
+	// AbuseIPDB lists, and for GeoJS failing, a fetch of a list failing, a
+	// query to a DNSBL zone or a check with AbuseIPDB failing, or the day's
+	// AbuseIPDB checks used up.
 	Alerts *alerts.Queue
 }
 
@@ -202,8 +203,9 @@ func newReputation(
 	cfg := params.Config
 	lists := reputation.New(reputation.Params{
 		BlocklistURLs: cfg.BlocklistURLs, Refresh: cfg.BlocklistRefresh,
-		ASNLimitPercentURL: cfg.ASNLimitPercentURL, Now: params.Now,
-		ProcessLog: params.ProcessLog, Alerts: params.Alerts,
+		ASNLimitPercentURL:   cfg.ASNLimitPercentURL,
+		CrowdSecDecisionsURL: cfg.CrowdSecDecisionsURL, CrowdSecKey: cfg.CrowdSecKey,
+		Now: params.Now, ProcessLog: params.ProcessLog, Alerts: params.Alerts,
 	})
 	dnsbl := reputation.NewDNSBL(reputation.DNSBLParams{
 		Zones: cfg.DNSBLZones, Resolver: cfg.DNSBLResolver, CacheTTL: cfg.ReputationCacheTTL,