Add asn= and prefix= tags from a routewatch instance (closes #204)

With `SWW_ROUTEWATCH_URL` set, a new heuristic, `routewatch_tags`, adds `asn=<number>` and `prefix=<netblock>` to a request from what a routewatch instance answers about the client. New package `internal/routewatch` asks in the background, never on a request's path, and keeps answers 1 hour in memory. The request log gains `routewatch_tags_missing`, saying why a request has none. `prefix=` works in `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT`.

Trips a reader: a client's first request has no routewatch tags, so `prefix=` refuses from its next request after the answer comes.
Judgement call: with `SWW_LOOKUP_SOURCE=off` and `SWW_ROUTEWATCH_URL` set, an `asn=` tag no longer stops the start.

Model: opus-5-5

SPEC.md

@@ -87,6 +87,8 @@ to them.
       database.
     - `internal/reputation`: fetches the lists, asks the DNS blocklists and
       AbuseIPDB in the background, and keeps their answers.
+    - `internal/routewatch`: asks a routewatch instance about clients in the
+      background, and keeps its answers.
     - `internal/anomaly`: the anomaly counters and their alerts.
     - `internal/alerts`: holds back repeats and alerts past the hourly limit,
       and sends the rest to the webhook, Slack and ntfy, each from a queue of
@@ -144,7 +146,9 @@ request log's `heuristic` field gives that name. `refusal_limit` and
       around its address, a /64 by default, since one abuser usually controls a
       whole /64. A client is therefore one IPv4 address or one IPv6 group.
 3. The tag lists (`tag_lists`; see "Request tags"). Each list that holds the
-   client adds its tag. A client in `SWW_ALLOW_NETS` gets no tag.
+   client adds its tag. Next, `routewatch_tags` adds the client's `asn=` and
+   `prefix=` tags while `SWW_ROUTEWATCH_URL` is set. A client in
+   `SWW_ALLOW_NETS` gets no tag.
 4. The static lists. A client in `SWW_ALLOW_NETS` skips steps 5 to 15, the byte
    limits and the error burst. A client in `SWW_DENY_NETS` is refused
    (`deny_nets`); a client in both lists is let through.
@@ -554,6 +558,21 @@ Each tag and where it comes from:
 - `exploitsignature`, when a rule file or the Core Rule Set matched the request.
   For the Core Rule Set a match is a score at or over
   `SWW_WAF_ANOMALY_THRESHOLD`.
+- `asn=<number>` and `prefix=<netblock>` from a routewatch instance
+  (`routewatch_tags`), while `SWW_ROUTEWATCH_URL` is set:
+    - The tag `prefix=` holds the netblock the client's address is announced in,
+      such as `prefix=192.0.2.0/24`.
+    - An `asn=` tag has the same spelling as the lookup's. When routewatch and
+      the lookup give the same AS number, a request has one `asn=` tag. When
+      they differ, it has both.
+    - They are added before `deny_nets`, so the log line of a request it refused
+      has them.
+    - `discriminator` asks routewatch in the background and never waits for it.
+      An answer is kept for 1 hour, in memory only.
+    - After a query fails, routewatch is not asked for 1 minute.
+    - A request without these tags gives the reason in the log field
+      `routewatch_tags_missing` (see
+      [`docs/request-log.md`](docs/request-log.md)).
 
 A client in `SWW_ALLOW_NETS` skips the checks and gets no tag. Every tag is in
 lower case, except a country code, which is in capitals. `SWW_TAG_DENY` and
@@ -571,7 +590,9 @@ Two settings act on tags:
 
 The tag settings are empty by default, for the same reason as the country list.
 The lookup waits for GeoJS when either names an `asn=` or `country=` tag. A
-setting that names one stops the start while `SWW_LOOKUP_SOURCE` is `off`.
+setting that names one stops the start while `SWW_LOOKUP_SOURCE` is `off`. The
+exception is an `asn=` tag while `SWW_ROUTEWATCH_URL` is set, since routewatch
+gives that tag.
 
 ### Biased thresholds