Add asn= and prefix= tags from a routewatch instance (closes #204)

With `SWW_ROUTEWATCH_URL` set, a new heuristic, `routewatch_tags`, adds `asn=<number>` and `prefix=<netblock>` to a request from what a routewatch instance answers about the client. New package `internal/routewatch` asks in the background, never on a request's path, and keeps answers 1 hour in memory. The request log gains `routewatch_tags_missing`, saying why a request has none. `prefix=` works in `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT`.

Trips a reader: a client's first request has no routewatch tags, so `prefix=` refuses from its next request after the answer comes.
Judgement call: with `SWW_LOOKUP_SOURCE=off` and `SWW_ROUTEWATCH_URL` set, an `asn=` tag no longer stops the start.

Model: opus-5-5

internal/discriminator/proxy.go

@@ -20,6 +20,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/routewatch"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
@@ -85,7 +86,8 @@ type Params struct {
 // Server is the server discriminator runs, with the parts whose state the state
 // files keep, the lookup database, nil unless SWW_LOOKUP_SOURCE is file, the
 // lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts,
-// AbuseIPDB's scores and checks spent, and the metrics.
+// AbuseIPDB's scores and checks spent, and the metrics. RouteWatch, nil while
+// SWW_ROUTEWATCH_URL is unset, keeps its answers in memory only.
 type Server struct {
 	*http.Server
 
@@ -97,6 +99,7 @@ type Server struct {
 	Lists      *reputation.Lists
 	DNSBL      *reputation.DNSBL
 	AbuseIPDB  *reputation.AbuseIPDB
+	RouteWatch *routewatch.Client
 	Metrics    *metrics.Metrics
 }
 
@@ -152,6 +155,12 @@ func newHandler(params Params) *handler {
 		coreRuleSet: params.CoreRuleSet,
 		alerts:      params.Alerts,
 	}
+	if params.Config.RouteWatchURL != "" {
+		h.routeWatch = routewatch.New(routewatch.Params{
+			URL: params.Config.RouteWatchURL, Now: params.Now, ProcessLog: params.ProcessLog,
+		})
+	}
+
 	h.geojs = lookup.New(lookup.Params{
 		URL:     params.GeoJSURL,
 		Timeout: params.Config.LookupTimeout,
@@ -255,6 +264,7 @@ type handler struct {
 	lists       *reputation.Lists
 	dnsbl       *reputation.DNSBL
 	abuseIPDB   *reputation.AbuseIPDB
+	routeWatch  *routewatch.Client
 	rules       *rules.Files
 	coreRuleSet *waf.CoreRuleSet
 	alerts      *alerts.Queue