servewaf: each decision heuristic is its own module (closes #195)

Each check servewaf runs on a request is a type in its own file behind
one interface, heuristic, and is registered in one of four ordered lists
in heuristics.go. Order and behaviour are unchanged.

Every refusal or ban now logs heuristic, the name of the heuristic that
made it, and heuristic_figures, the figures it acted on. Both are in
docs/request-log.md, and SPEC.md names each heuristic at its step.

Model: opus-5-5

internal/servewaf/abuseipdb.go

@@ -0,0 +1,55 @@
+package servewaf
+
+// The heuristic abuseipdb. It reads SWWAF_ABUSEIPDB_KEY,
+// SWWAF_ABUSEIPDB_MIN_SCORE and SWWAF_REPUTATION_ACTION.
+
+import (
+	"context"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
+	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// abuseIPDB notes AbuseIPDB, as noteHit does, with the score, when its score
+// of the client is a hit, and refuses the request when SWWAF_REPUTATION_ACTION
+// is deny, as dnsbl does for a zone. While SWWAF_ABUSEIPDB_KEY is unset it does
+// nothing. A client without a score is checked in the background, by the
+// request's address, if its history counts an offence, and the request does
+// not wait for the answer. The score is then used for each address of the
+// client. Its figures are the score and SWWAF_ABUSEIPDB_MIN_SCORE.
+type abuseIPDB struct{}
+
+func (abuseIPDB) name() string { return "abuseipdb" }
+
+func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
+	if rq.h.config.AbuseIPDBKey == "" {
+		return nil
+	}
+
+	client := rq.h.clientGroup(rq.client)
+	held, _ := rq.h.limiter.Client(client)
+	offender := held.History.Offences != ratelimit.Offences{}
+
+	score, hit := rq.h.abuseIPDB.Hit(ctx, client, rq.client, offender)
+	if !hit {
+		return nil
+	}
+
+	rq.abuseIPDBHit = true
+	rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
+		"scored by AbuseIPDB at or over SWWAF_ABUSEIPDB_MIN_SCORE")
+
+	if rq.h.config.ReputationAction != deny {
+		return nil
+	}
+
+	return &verdict{
+		action: requestlog.ActionDenied,
+		figures: map[string]any{
+			figureScore: score, "min_score": rq.h.config.AbuseIPDBMinScore,
+		},
+	}
+}