CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

SWWAF_CROWDSEC_LAPI_URL and SWWAF_CROWDSEC_LAPI_KEY name an engine whose
decision list, <url>/v1/decisions, is fetched every minute with the key in
X-Api-Key, following no redirect, and kept as a blocklist is: used while a
fetch fails, and across restarts through reputation.json. Ban decisions on an
Ip or a Range end at the fetch time plus their duration. A listed client's
request is refused and bans its netblock with the cause crowdsec until the
decision ends; bans.json, ban notes and metrics take the cause.

Judgement call: fetched every minute, not a setting.
Judgement call: a crowdsec ban never lengthens a limit ban.
Judgement call: a lifted crowdsec ban is remade while its decision lasts.

Model: opus-5-5

internal/proxy/reputation.go

@@ -2,6 +2,7 @@ package proxy
 
 import (
 	"context"
+	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
@@ -25,6 +26,22 @@ func (rq *request) blocklistDenied() bool {
 	return rq.blocklisted && rq.h.config.BlocklistAction == deny
 }
 
+// crowdSecBanned reports whether a decision of the CrowdSec decision list
+// on the client is in force at now. If one is, it notes the list, as
+// noteHit does, and bans the client until that decision ends.
+func (rq *request) crowdSecBanned(now time.Time) bool {
+	decision, listed := rq.h.lists.CrowdSecDecision(rq.client, now)
+	if !listed {
+		return false
+	}
+
+	rq.noteHit(bans.ReputationHit{Source: rq.h.config.CrowdSecDecisionsURL},
+		"listed by the CrowdSec decision list")
+	rq.banForCrowdSec(now, decision)
+
+	return true
+}
+
 // dnsblDenied notes the DNSBL zones whose verdict lists the client, as
 // noteListed does, and reports whether SWWAF_REPUTATION_ACTION, being
 // deny, refuses the request. Being limit, it lowers the client's limits