Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/reputation/reputation.go

@@ -1,7 +1,8 @@
 // Package reputation fetches the lists the settings name by URL: the
 // blocklists of SWW_BLOCKLIST_URLS, the file of AS:percent lines
-// SWW_ASN_LIMIT_PERCENT_URL names, and the decision list of the CrowdSec
-// engine SWW_CROWDSEC_LAPI_URL names. It keeps the last good copy of
+// SWW_ASN_LIMIT_PERCENT_URL names, the address lists of SWW_TAG_LISTS, and
+// the decision list of the CrowdSec engine SWW_CROWDSEC_LAPI_URL names. It
+// keeps the last good copy of
 // each, whole, comment lines included, which is used while a fetch fails,
 // and when each was last tried. It also asks the DNSBL zones of
 // SWW_DNSBL_ZONES about clients, and keeps their verdicts, and checks
@@ -71,6 +72,8 @@ type Params struct {
 	// (SWW_ASN_LIMIT_PERCENT_URL), "" while it is unset.
 	BlocklistURLs      []string
 	ASNLimitPercentURL string
+	// TagLists are the address lists that add a tag (SWW_TAG_LISTS).
+	TagLists []config.TagList
 	// CrowdSecDecisionsURL is the CrowdSec decision list, "" while
 	// SWW_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
 	// (SWW_CROWDSEC_LAPI_KEY).
@@ -152,14 +155,18 @@ func New(params Params) *Lists {
 }
 
 // URLs returns the URL of every list: the blocklists' in the order
-// SWW_BLOCKLIST_URLS names them, then SWW_ASN_LIMIT_PERCENT_URL, then
-// the CrowdSec decision list's.
+// SWW_BLOCKLIST_URLS names them, then SWW_ASN_LIMIT_PERCENT_URL, then the
+// tag lists', then the CrowdSec decision list's.
 func (l *Lists) URLs() []string {
 	urls := slices.Clone(l.params.BlocklistURLs)
 	if l.params.ASNLimitPercentURL != "" {
 		urls = append(urls, l.params.ASNLimitPercentURL)
 	}
 
+	for _, list := range l.params.TagLists {
+		urls = append(urls, list.URL)
+	}
+
 	if l.params.CrowdSecDecisionsURL != "" {
 		urls = append(urls, l.params.CrowdSecDecisionsURL)
 	}
@@ -184,6 +191,22 @@ func (l *Lists) ListedBy(addr netip.Addr) []string {
 	return listedBy
 }
 
+// TagsOf returns the names of the tag lists whose copy holds addr.
+func (l *Lists) TagsOf(addr netip.Addr) []string {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	var names []string
+
+	for _, list := range l.params.TagLists {
+		if l.lists[list.URL].entries.contain(addr) {
+			names = append(names, list.Name)
+		}
+	}
+
+	return names
+}
+
 // ASNLimitPercent returns the percentage the copy of the file of
 // AS:percent lines gives asn, and whether it lists asn.
 func (l *Lists) ASNLimitPercent(asn string) (int64, bool) {
@@ -551,7 +574,7 @@ func parseNetblock(text string) (netip.Prefix, bool) {
 }
 
 // parsePercents reads the lines of the file of AS:percent lines, each an
-// AS number, : and a percentage, as SWW_ASN_LIMIT_PERCENT takes them. An
+// AS number, : and a percentage, such as AS64496:50. An
 // AS number listed more than once gets the lowest of its percentages.
 func parsePercents(lines []string) (entries, error) {
 	found := entries{percents: map[string]int64{}}