Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/discriminator/countries.go

@@ -1,7 +1,6 @@
 package discriminator
 
-// The heuristic countries. It reads SWW_DENIED_COUNTRIES and
-// SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
+// The heuristic countries. It reads SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
 
 import (
 	"context"
@@ -11,32 +10,26 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// countries refuses a request by the client's country as it was looked up. A
-// client without a country, or whose country cannot be found, is refused only
-// by SWW_EXCLUSIVELY_ALLOWED_COUNTRIES. Its figures are the country and the
-// setting that refused it.
+// countries refuses a request when SWW_EXCLUSIVELY_ALLOWED_COUNTRIES is set and
+// does not hold the client's country as it was looked up. A client without a
+// country, or whose country cannot be found, is refused. Its figures are the
+// country and the setting that refused it.
 type countries struct{}
 
 func (countries) name() string { return "countries" }
 
 func (countries) check(_ context.Context, rq *request, _ time.Time) *verdict {
-	denied := rq.h.config.DeniedCountries
 	allowed := rq.h.config.ExclusivelyAllowedCountries
 	country := rq.line.Country
 
-	var setting string
-
-	switch {
-	case slices.Contains(denied, country):
-		setting = "SWW_DENIED_COUNTRIES"
-	case len(allowed) > 0 && !slices.Contains(allowed, country):
-		setting = "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"
-	default:
+	if len(allowed) == 0 || slices.Contains(allowed, country) {
 		return nil
 	}
 
 	return &verdict{
-		action:  requestlog.ActionCountryDenied,
-		figures: map[string]any{"country": country, "setting": setting},
+		action: requestlog.ActionCountryDenied,
+		figures: map[string]any{
+			"country": country, "setting": "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES",
+		},
 	}
 }