Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

A request over a rate limit is refused with SWWAF_BAN_RESPONSE and bans
the client's netblock: an hour at first, three times the last ban when
broken again within a day of its end, permanent past seven days. The
ban ledger in internal/bans is checked after the static lists and
before the lookup, and the requests it refuses are not counted. A ban
resets the client's counters and carries notes holding the request
that broke the limit, as SPEC.md now says. At most SWWAF_MAX_BANS are
held. SWWAF_BAN_RESPONSE also answers SWWAF_DENY_NETS and the country
lists.

Judgement call: the six ban settings cannot be off.
Judgement call: a permanent ban's ban_expires is "permanent".

Model: opus-5-5

internal/proxy/proxy_test.go

@@ -57,8 +57,15 @@ const (
 	rateLimitExemptNets     = "SWWAF_RATE_LIMIT_EXEMPT_NETS"
 	denyNets                = "SWWAF_DENY_NETS"
 	rateLimitPerMinute      = "SWWAF_RATE_LIMIT_PER_MINUTE"
+	rateLimitPerDay         = "SWWAF_RATE_LIMIT_PER_DAY"
 	deniedCountries         = "SWWAF_DENIED_COUNTRIES"
 	allowedCountries        = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	banResponse             = "SWWAF_BAN_RESPONSE"
+	limitBanDuration        = "SWWAF_LIMIT_BAN_DURATION"
+	limitBanRepeatWindow    = "SWWAF_LIMIT_BAN_REPEAT_WINDOW"
+	maxBanDuration          = "SWWAF_MAX_BAN_DURATION"
+	maxBans                 = "SWWAF_MAX_BANS"
+	banScopeV4Prefix        = "SWWAF_BAN_SCOPE_V4_PREFIX"
 )
 
 // output collects what smallwebwaf writes on stdout.
@@ -183,6 +190,19 @@ func startProxyWithGeoJS(
 ) (string, *output) {
 	t.Helper()
 
+	addr, out, _ := startProxyWithClock(t, appURL, geojsURL, time.Now, env)
+
+	return addr, out
+}
+
+// startProxyWithClock is startProxyWithGeoJS with requests counted and
+// bans made by the time now tells, and returns the server as well.
+func startProxyWithClock(
+	t *testing.T, appURL, geojsURL string, now func() time.Time,
+	env map[string]string,
+) (string, *output, *http.Server) {
+	t.Helper()
+
 	settings := map[string]string{"SWWAF_UPSTREAM_URL": appURL}
 	maps.Copy(settings, env)
 
@@ -201,6 +221,7 @@ func startProxyWithGeoJS(
 		RequestLog: out,
 		ProcessLog: requestlog.NewProcessLogger(out),
 		GeoJSURL:   geojsURL,
+		Now:        now,
 	})
 
 	listener, err := (&net.ListenConfig{}).Listen(t.Context(), "tcp", localhost+":0")
@@ -216,7 +237,7 @@ func startProxyWithGeoJS(
 		_ = server.Close()
 	})
 
-	return listener.Addr().String(), out
+	return listener.Addr().String(), out, server
 }
 
 // newClient returns an HTTP client that sends requests as they are made,