CrowdSec decision list fetched, kept, and its clients banned until the decision ends (closes #106)

SWWAF_CROWDSEC_LAPI_URL and SWWAF_CROWDSEC_LAPI_KEY name an engine whose
decision list, <url>/v1/decisions, is fetched every minute with the key in
X-Api-Key, following no redirect, and kept as a blocklist is: used while a
fetch fails, and across restarts through reputation.json. Ban decisions on an
Ip or a Range end at the fetch time plus their duration. A listed client's
request is refused and bans its netblock with the cause crowdsec until the
decision ends; bans.json, ban notes and metrics take the cause.

Judgement call: fetched every minute, not a setting.
Judgement call: a crowdsec ban never lengthens a limit ban.
Judgement call: a lifted crowdsec ban is remade while its decision lasts.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -29,7 +29,8 @@ const (
 	// over a rate limit, which bans the client.
 	ActionRateLimited = "rate_limited"
 	// ActionBanned is a request refused because a ban covers its client,
-	// or because it matched a ban rule, which bans the client.
+	// or because it matched a ban rule or the CrowdSec decision list lists
+	// its client, either of which bans the client.
 	ActionBanned = "banned"
 	// ActionRuleBlocked is a request refused because it matched a block
 	// rule.
@@ -140,8 +141,9 @@ type Line struct {
 	// minute_bytes, hour_bytes or day_bytes for a byte limit.
 	LimitHit string `json:"limit_hit,omitempty"`
 	// Reputation are the URLs of the blocklists that list the client, then
-	// the DNSBL zones whose verdict lists it, their keys masked, then
-	// abuseipdb when its score is a hit.
+	// that of the CrowdSec decision list when it does, then the DNSBL zones
+	// whose verdict lists it, their keys masked, then abuseipdb when its
+	// score is a hit.
 	Reputation []string `json:"reputation,omitempty"`
 	// Offence is the offence the request was held as, OffenceLimit.
 	Offence string `json:"offence,omitempty"`