servewaf: each decision heuristic is its own module (closes #195)

Each check servewaf runs on a request is a type in its own file behind
one interface, heuristic, and is registered in one of four ordered lists
in heuristics.go. Order and behaviour are unchanged.

Every refusal or ban now logs heuristic, the name of the heuristic that
made it, and heuristic_figures, the figures it acted on. Both are in
docs/request-log.md, and SPEC.md names each heuristic at its step.

Model: opus-5-5

internal/servewaf/rulefiles.go

@@ -0,0 +1,55 @@
+package servewaf
+
+// The heuristic rule_files. It reads the rules of the rule files, which
+// SWWAF_RULES_DIR and SWWAF_RULES_ENABLED name.
+
+import (
+	"context"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rules"
+)
+
+// ruleFiles checks the request against the rules of the rule files at now,
+// notes the ids of those it matches in the log line, and refuses the request
+// when the last rule it matches refuses it: with ActionRuleBlocked for a block
+// rule, and ActionBanned for a ban rule. A ban rule bans the client's netblock
+// for a clear sign of attack, or in observe mode raises the alert for the ban
+// it would have made. Either rule's match is noted as an offence, for the
+// client's history. Its figures are the rule's id and action.
+type ruleFiles struct{}
+
+func (ruleFiles) name() string { return "rule_files" }
+
+func (ruleFiles) check(_ context.Context, rq *request, now time.Time) *verdict {
+	matched := rq.h.rules.Match(rq.in)
+
+	for _, rule := range matched {
+		rq.line.RuleIDs = append(rq.line.RuleIDs, rule.ID)
+		rq.h.metrics.RuleMatched(rule.ID, rule.Action)
+	}
+
+	if len(matched) == 0 {
+		return nil
+	}
+
+	// Only the last rule matched can refuse the request.
+	last := matched[len(matched)-1]
+	figures := map[string]any{"rule_id": last.ID, "rule_action": last.Action}
+
+	switch last.Action {
+	case rules.ActionBlock:
+		rq.ruleBlocked = true
+
+		return &verdict{action: requestlog.ActionRuleBlocked, figures: figures}
+	case rules.ActionBan:
+		rq.attack = true
+		rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target})
+
+		return &verdict{action: requestlog.ActionBanned, figures: figures}
+	default:
+		return nil
+	}
+}