Add asn= and prefix= tags from a routewatch instance (closes #204)

SWW_ROUTEWATCH_URL names the instance. The new heuristic routewatch_tags
asks it in the background about each client and tags the request. Answers
are kept in memory for an hour. A request without tags gives the reason in
routewatch_tags_missing, and it is never delayed or refused.

Model: opus-5-5

docs/settings.md

@@ -186,11 +186,19 @@ Every request gets tags from what `discriminator` knows of its client. See
   `exploitsignature`: a request gets that tag after the rate limits have counted
   it.
 
+- `SWW_ROUTEWATCH_URL` (default unset): the `http` or `https` URL of a
+  routewatch instance. `discriminator` asks it about each client, in the
+  background, and adds the tags `asn=<number>` and `prefix=<netblock>` from its
+  answer. While it is unset, nothing asks routewatch and no request gets a
+  `prefix=` tag.
+
 `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT` accept tags in either case. A tag
 that no request can get stops the start. A request can get only these:
 
 - a name in `SWW_TAG_LISTS`;
 - an `asn=` or `country=` tag;
+- a `prefix=` tag with a netblock, while `SWW_ROUTEWATCH_URL` is set. It matches
+  only that exact announced netblock, such as `prefix=192.0.2.0/24`;
 - a `dnsbl=` tag of a zone in `SWW_DNSBL_ZONES`, in lower case, with a key
   masked as the `reputation` field shows it;
 - `abuseipdb`, while `SWW_ABUSEIPDB_KEY` is set;