Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/discriminator/metrics_test.go

@@ -195,10 +195,10 @@ func TestMetricsByCountryKeepTheBusiestAndCountTheRestAsOther(t *testing.T) {
 		_, _ = io.WriteString(w, "hello")
 	})
 	env := map[string]string{
-		trustedProxies:  trustLocalhost,
-		metricsToken:    token,
-		metricsTopN:     "2",
-		deniedCountries: "kp",
+		trustedProxies:   trustLocalhost,
+		metricsToken:     token,
+		metricsTopN:      "2",
+		allowedCountries: "de,fr",
 	}
 	geojsURL, _ := startGeoJS(t)
 	addr, out, server := startProxyWithClock(t, app.URL, geojsURL, time.Now, env)
@@ -322,13 +322,13 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
 	addr, _, server := startProxyWithClock(t, app.URL, geojs.URL, time.Now,
 		map[string]string{
-			trustedProxies:  trustLocalhost,
-			metricsToken:    token,
-			deniedCountries: "kp",
+			trustedProxies: trustLocalhost,
+			metricsToken:   token,
+			tagDeny:        denyKP,
 		})
 
-	// GeoJS fails, so the client counts as coming from an unknown country,
-	// which SWW_DENIED_COUNTRIES does not refuse.
+	// GeoJS fails, so the client has no country= tag, and SWW_TAG_DENY does
+	// not refuse it.
 	req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
 	req.Header.Set(forwardedFor, fromDE)
 	wantStatus(t, do(t, req), http.StatusOK)