Add asn= and prefix= tags from a routewatch instance (closes #204)

SWW_ROUTEWATCH_URL names the instance. The new heuristic routewatch_tags
asks it in the background about each client and tags the request. Answers
are kept in memory for an hour. A request without tags gives the reason in
routewatch_tags_missing, and it is never delayed or refused.

Model: opus-5-5

SPEC.md

@@ -144,7 +144,9 @@ request log's `heuristic` field gives that name. `refusal_limit` and
       around its address, a /64 by default, since one abuser usually controls a
       whole /64. A client is therefore one IPv4 address or one IPv6 group.
 3. The tag lists (`tag_lists`; see "Request tags"). Each list that holds the
-   client adds its tag. A client in `SWW_ALLOW_NETS` gets no tag.
+   client adds its tag. Next, `routewatch_tags` adds the client's `asn=` and
+   `prefix=` tags while `SWW_ROUTEWATCH_URL` is set. A client in
+   `SWW_ALLOW_NETS` gets no tag.
 4. The static lists. A client in `SWW_ALLOW_NETS` skips steps 5 to 15, the byte
    limits and the error burst. A client in `SWW_DENY_NETS` is refused
    (`deny_nets`); a client in both lists is let through.
@@ -154,8 +156,8 @@ request log's `heuristic` field gives that name. `refusal_limit` and
    up to `SWW_LOOKUP_TIMEOUT`, only when one of these needs it:
     - the country list;
     - a biased threshold;
-    - `SWW_TAG_DENY` or `SWW_TAG_LIMIT_PERCENT` naming an `asn=` or `country=`
-      tag;
+    - `SWW_TAG_DENY` or `SWW_TAG_LIMIT_PERCENT` naming a `country=` tag, or an
+      `asn=` tag while `SWW_ROUTEWATCH_URL` is unset;
     - `SWW_ADD_LOOKUP_HEADERS`.
 
     A request that ends before the answer comes is logged without it.
@@ -554,6 +556,19 @@ Each tag and where it comes from:
 - `exploitsignature`, when a rule file or the Core Rule Set matched the request.
   For the Core Rule Set a match is a score at or over
   `SWW_WAF_ANOMALY_THRESHOLD`.
+- `asn=<number>` and `prefix=<netblock>` from a routewatch instance
+  (`routewatch_tags`), while `SWW_ROUTEWATCH_URL` is set:
+    - The tag `prefix=` holds the netblock the client's address is announced in,
+      such as `prefix=192.0.2.0/24`.
+    - An `asn=` tag has the same spelling as the lookup's. A request carries it
+      once, and carries both when the two sources disagree.
+    - These tags come before `deny_nets`, so a line that check refused has them.
+    - `discriminator` asks routewatch in the background and never waits for it.
+      An answer is kept for 1 hour, in memory only.
+    - After a query fails, routewatch is not asked for 1 minute.
+    - A request without these tags gives the reason in the log field
+      `routewatch_tags_missing` (see
+      [`docs/request-log.md`](docs/request-log.md)).
 
 A client in `SWW_ALLOW_NETS` skips the checks and gets no tag. Every tag is in
 lower case, except a country code, which is in capitals. `SWW_TAG_DENY` and