Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/metrics/busiest.go

@@ -25,7 +25,7 @@ type busiest struct {
 	requests      *prometheus.CounterVec
 	requestBytes  *prometheus.CounterVec
 	responseBytes *prometheus.CounterVec
-	// refused are, by country, the requests the country lists refused; nil
+	// refused are, by country, the requests the country list refused; nil
 	// by AS number.
 	refused *prometheus.CounterVec
 
@@ -42,7 +42,7 @@ type busiest struct {
 func newCountries(topN int) *busiest {
 	countries := newBusiest(topN, "country", "the client's country")
 	countries.refused = counterVec("sww_country_list_refusals_total",
-		"Requests the country lists refused, by the client's country.",
+		"Requests SWW_EXCLUSIVELY_ALLOWED_COUNTRIES refused, by the client's country.",
 		[]string{"country"})
 
 	return countries