servewaf: each decision heuristic is its own module (closes #195)

Each check servewaf runs on a request is a type in its own file behind
one interface, heuristic, and is registered in one of four ordered lists
in heuristics.go. Order and behaviour are unchanged.

Every refusal or ban now logs heuristic, the name of the heuristic that
made it, and heuristic_figures, the figures it acted on. Both are in
docs/request-log.md, and SPEC.md names each heuristic at its step.

Model: opus-5-5

internal/servewaf/countries.go

@@ -1,21 +1,42 @@
 package servewaf
 
+// The heuristic countries. It reads SWWAF_DENIED_COUNTRIES and
+// SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES.
+
 import (
+	"context"
 	"slices"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// countryDenied reports whether the country lists refuse the request, by
-// the client's country as it was looked up. A client without a country,
-// or whose country cannot be found, is refused only by
-// SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES.
-func (rq *request) countryDenied() bool {
+// countries refuses a request by the client's country as it was looked up. A
+// client without a country, or whose country cannot be found, is refused only
+// by SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES. Its figures are the country and the
+// setting that refused it.
+type countries struct{}
+
+func (countries) name() string { return "countries" }
+
+func (countries) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	denied := rq.h.config.DeniedCountries
 	allowed := rq.h.config.ExclusivelyAllowedCountries
 	country := rq.line.Country
 
-	if slices.Contains(denied, country) {
-		return true
+	var setting string
+
+	switch {
+	case slices.Contains(denied, country):
+		setting = "SWWAF_DENIED_COUNTRIES"
+	case len(allowed) > 0 && !slices.Contains(allowed, country):
+		setting = "SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES"
+	default:
+		return nil
 	}
 
-	return len(allowed) > 0 && !slices.Contains(allowed, country)
+	return &verdict{
+		action:  requestlog.ActionCountryDenied,
+		figures: map[string]any{"country": country, "setting": setting},
+	}
 }