Add asn= and prefix= tags from a routewatch instance (closes #204)

With `SWW_ROUTEWATCH_URL` set, a new heuristic, `routewatch_tags`, adds `asn=<number>` and `prefix=<netblock>` to a request from what a routewatch instance answers about the client. New package `internal/routewatch` asks in the background, never on a request's path, and keeps answers 1 hour in memory. The request log gains `routewatch_tags_missing`, saying why a request has none. `prefix=` works in `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT`.

Trips a reader: a client's first request has no routewatch tags, so `prefix=` refuses from its next request after the answer comes.
Judgement call: with `SWW_LOOKUP_SOURCE=off` and `SWW_ROUTEWATCH_URL` set, an `asn=` tag no longer stops the start.

Model: opus-5-5

docs/request-log.md

@@ -173,6 +173,12 @@ Every one of these lines has:
     - `abuseipdb`.
 - `tags`: the request's tags, sorted, left out when it has none. Each tag and
   where it comes from is under "Request tags" in [`SPEC.md`](../SPEC.md).
+- `routewatch_tags_missing`: why the request got no tags from routewatch,
+  present only while `SWW_ROUTEWATCH_URL` is set:
+    - `no_answer_yet`: routewatch has not answered about this client yet;
+    - `request_failed`: a query to routewatch failed within the last minute, and
+      the process log says why;
+    - `no_route`: routewatch knows no live route for the address.
 - `offence`: `limit`, for a request that broke a limit.
 - `ban_expires`: when the client's ban ends, for a request that made one or was
   refused under one: a time, or `permanent`.