Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

A request over a rate limit is refused with SWWAF_BAN_RESPONSE and bans
the client's netblock: an hour at first, three times the last ban when
broken again within a day of its end, permanent past seven days. The
ban ledger in internal/bans is checked after the static lists and
before the lookup, and the requests it refuses are not counted. A ban
resets the client's counters and carries notes holding the request
that broke the limit, as SPEC.md now says. At most SWWAF_MAX_BANS are
held. SWWAF_BAN_RESPONSE also answers SWWAF_DENY_NETS and the country
lists.

Judgement call: the six ban settings cannot be off.
Judgement call: a permanent ban's ban_expires is "permanent".

Model: opus-5-5

internal/proxy/proxy.go

@@ -10,6 +10,7 @@ import (
 	"net/http"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
@@ -36,6 +37,9 @@ type Params struct {
 	// GeoJSURL is where clients' countries are looked up, normally
 	// lookup.URL. GeoJS is asked only while a country list is set.
 	GeoJSURL string
+	// Now tells the time by which requests are counted for the rate
+	// limits and bans are made and run out, normally time.Now.
+	Now func() time.Time
 }
 
 // New returns the server smallwebwaf runs: each request it reads passes
@@ -55,11 +59,18 @@ func New(params Params) *http.Server {
 			processLog: params.ProcessLog,
 			errorLog:   errorLog,
 			transport:  newTransport(),
+			now:        params.Now,
 			limiter: ratelimit.New(ratelimit.Limits{
 				PerMinute: params.Config.RateLimitPerMinute,
 				PerHour:   params.Config.RateLimitPerHour,
 				PerDay:    params.Config.RateLimitPerDay,
 			}),
+			ledger: bans.New(bans.Rules{
+				LimitBanDuration:     params.Config.LimitBanDuration,
+				LimitBanRepeatWindow: params.Config.LimitBanRepeatWindow,
+				MaxBanDuration:       params.Config.MaxBanDuration,
+				MaxBans:              params.Config.MaxBans,
+			}),
 			geojs: lookup.New(lookup.Params{
 				URL:        params.GeoJSURL,
 				Now:        time.Now,
@@ -85,7 +96,9 @@ type handler struct {
 	processLog *slog.Logger
 	errorLog   *log.Logger
 	transport  http.RoundTripper
+	now        func() time.Time
 	limiter    *ratelimit.Limiter
+	ledger     *bans.Ledger
 	geojs      *lookup.GeoJS
 }