Ban the netblock of a client that breaks a rate limit, in memory (closes #18)

A request over a rate limit is refused with SWWAF_BAN_RESPONSE and bans
the client's netblock: an hour at first, three times the last ban when
broken again within a day of its end, permanent past seven days. The
ban ledger in internal/bans is checked after the static lists and
before the lookup, and the requests it refuses are not counted. A ban
resets the client's counters and carries notes holding the request
that broke the limit, as SPEC.md now says. At most SWWAF_MAX_BANS are
held. SWWAF_BAN_RESPONSE also answers SWWAF_DENY_NETS and the country
lists.

Judgement call: the six ban settings cannot be off.
Judgement call: a permanent ban's ban_expires is "permanent".

Model: opus-5-5

internal/smallwebwaf/smallwebwaf.go

@@ -80,6 +80,7 @@ func Run(ctx context.Context, params Params) int {
 		RequestLog: params.Stdout,
 		ProcessLog: processLog,
 		GeoJSURL:   lookup.URL,
+		Now:        time.Now,
 	})
 
 	processLog.Info("starting",

internal/smallwebwaf/smallwebwaf_test.go

@@ -196,6 +196,12 @@ func wantStartingLine(t *testing.T, line map[string]any, appURL string) {
 		"SWWAF_RATE_LIMIT_PER_DAY":              "50000",
 		"SWWAF_DENIED_COUNTRIES":                "",
 		"SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES":   "",
+		"SWWAF_BAN_RESPONSE":                    "403",
+		"SWWAF_LIMIT_BAN_DURATION":              "1h",
+		"SWWAF_LIMIT_BAN_REPEAT_WINDOW":         "24h",
+		"SWWAF_MAX_BAN_DURATION":                "7d",
+		"SWWAF_MAX_BANS":                        "5000",
+		"SWWAF_BAN_SCOPE_V4_PREFIX":             "32",
 	}
 
 	for name, value := range want {