CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

SWWAF_CROWDSEC_LAPI_URL and SWWAF_CROWDSEC_LAPI_KEY name an engine whose
decision list, <url>/v1/decisions, is fetched every minute with the key in
X-Api-Key, following no redirect, and kept as a blocklist is: used while a
fetch fails, and across restarts through reputation.json. Ban decisions on an
Ip or a Range end at the fetch time plus their duration. A listed client's
request is refused and bans its netblock with the cause crowdsec until the
decision ends; bans.json, ban notes and metrics take the cause.

Judgement call: fetched every minute, not a setting.
Judgement call: a crowdsec ban never lengthens a limit ban.
Judgement call: a lifted crowdsec ban is remade while its decision lasts.

Model: opus-5-5

internal/reputation/reputation_test.go

@@ -215,12 +215,7 @@ func TestFailedFetchKeepsTheLastGoodCopyAndAlertsOncePerCooldown(t *testing.T) {
 
 				// One alert for the first failure; the cooldown holds back the
 				// second.
-				wantAlert(t, queue, alerts.Alert{
-					Time:   time.Now().Add(-refresh),
-					Event:  alerts.EventSourceFailure,
-					Reason: "fetching a list failed",
-					Detail: map[string]any{"source": dropURL, "error": tc.error},
-				})
+				wantAlert(t, queue, fetchFailure(time.Now().Add(-refresh), dropURL, tc.error))
 
 				if !strings.Contains(log.String(), `"msg":"fetching a list failed",`+
 					`"url":"`+dropURL+`","error":"`+tc.error) {
@@ -535,7 +530,9 @@ func newQueue() *alerts.Queue {
 
 // start returns the lists of p, fetched through servers by Run, which runs
 // until the test ends, once Run has fetched those due at start.
-func start(t *testing.T, servers *standIn, p reputation.Params) *reputation.Lists {
+func start(
+	t *testing.T, servers http.RoundTripper, p reputation.Params,
+) *reputation.Lists {
 	t.Helper()
 
 	lists := reputation.New(p)
@@ -597,6 +594,17 @@ func waiting(queue *alerts.Queue) []alerts.Alert {
 	return queue.Snapshot().Waiting[alerts.DestinationWebhook]
 }
 
+// fetchFailure is the source_failure alert raised at the time raised for
+// a fetch of the list at listURL that failed with err.
+func fetchFailure(raised time.Time, listURL, err string) alerts.Alert {
+	return alerts.Alert{
+		Time:   raised,
+		Event:  alerts.EventSourceFailure,
+		Reason: "fetching a list failed",
+		Detail: map[string]any{"source": listURL, "error": err},
+	}
+}
+
 // wantAlert checks that want is the one alert waiting in queue, and that
 // the cooldown has held back one repeat of it.
 func wantAlert(t *testing.T, queue *alerts.Queue, want alerts.Alert) {