Leave SWWAF_RATE_LIMIT_EXEMPT_PATHS out of the request rate limits (closes #77)

A request whose path, as the client sent it and before the query
string, starts with one of the comma-separated prefixes in
SWWAF_RATE_LIMIT_EXEMPT_PATHS is neither counted nor refused by the
request rate limits; the static lists, bans and the country lists still
apply. The setting is empty by default, and a prefix that does not start
with / stops the start. README.md documents it.

Judgement call: plain prefix on the path as sent, as the issue rules, so
/assets/../login matches /assets/; traefik removes such dot segments by
default, but a request that reaches smallwebwaf uncleaned is matched as
sent.

Model: opus-5-5

README.md

@@ -13,13 +13,14 @@ JSON log line for every request.
 
 Status: the first two milestones are built
 (https://git.eeqj.de/sneak/smallwebwaf/issues/13 and
-https://git.eeqj.de/sneak/smallwebwaf/issues/14), and so are five parts of
-milestone 3: the static lists, the bans that broken rate limits lead to and the
-JSON state files, which come next in the build order, and the metrics endpoint
-and the header size and the idle time as settings, which come last in it.
-`smallwebwaf` passes each request to the app and the app's answer back,
-unchanged, within its timeouts and size limits, works out each client's address,
-bans a client that sends too many requests, refuses a client that comes from a
+https://git.eeqj.de/sneak/smallwebwaf/issues/14), and so are six parts of
+milestone 3: the static lists, the bans that broken rate limits lead to, the
+JSON state files and the paths the rate limits do not count, which come next in
+the build order, and the metrics endpoint and the header size and the idle time
+as settings, which come last in it. `smallwebwaf` passes each request to the app
+and the app's answer back, unchanged, within its timeouts and size limits, works
+out each client's address, bans a client that sends too many requests, not
+counting those for the paths you choose, refuses a client that comes from a
 country you refuse or from a network you refuse, lets the networks you choose
 through, keeps its bans, each client's counters and history, and GeoJS's answers
 in JSON files across restarts, writes a JSON log line for every request, and
@@ -77,12 +78,14 @@ in `bin/state` unless `SWWAF_STATE_DIR` is set.
 - Counts each client's requests over a minute, an hour and a day. A request that
   takes the client over one of the rate limits below is refused with
   `SWWAF_BAN_RESPONSE`, `403` by default, before anything reaches the app, and
-  bans the client. A client is one IPv4 address, or one IPv6 /64, since one
-  abuser usually holds a whole /64. Each window is counted in two fixed buckets,
-  the earlier one weighted by how much of it the window still covers. At most
-  20,000 clients are kept, the least recently seen dropped first, with their
-  history, and a restart gives no client a fresh allowance (see "State files"
-  below).
+  bans the client. A request whose path starts with one of
+  `SWWAF_RATE_LIMIT_EXEMPT_PATHS` is neither counted nor refused by the rate
+  limits; the static lists, bans and the country lists still apply to it. A
+  client is one IPv4 address, or one IPv6 /64, since one abuser usually holds a
+  whole /64. Each window is counted in two fixed buckets, the earlier one
+  weighted by how much of it the window still covers. At most 20,000 clients are
+  kept, the least recently seen dropped first, with their history, and a restart
+  gives no client a fresh allowance (see "State files" below).
 - Bans a client that breaks a rate limit, as "Bans" in [`SPEC.md`](SPEC.md)
   describes: the first ban lasts an hour, and a limit broken again within a day
   of a ban ending bans for three times as long as that ban, so 1, 3, 9, 27 and
@@ -174,6 +177,14 @@ it, and the effective settings are logged at start.
   requests a client may make in a minute, an hour and a day. The defaults are
   several times what one busy person produces, since a browser loading a heavy
   page makes a few hundred requests and several people often share one address.
+- `SWWAF_RATE_LIMIT_EXEMPT_PATHS` (default empty): path prefixes whose requests
+  the rate limits neither count nor refuse, such as `/assets/` for static
+  assets; each starts with `/`. A prefix is compared with the start of the path
+  as the client sent it, before any query string, as the request log's `path`
+  shows it, character for character: `/assets/` matches `/assets/app.js` and
+  `/assets/img/logo.png`, but not `/assets`, `/Assets/app.js` or
+  `/static/assets/app.js`. There are no wildcards: `*` is a character like any
+  other.
 - `SWWAF_DENIED_COUNTRIES` (default empty): countries whose clients are refused,
   for example `cn,ru,kp`.
 - `SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES` (default empty): when set, the only