Network lists: always allowed, exempt from rate limits, always refused (closes #19)

Adds SWWAF_ALLOW_NETS, SWWAF_RATE_LIMIT_EXEMPT_NETS and SWWAF_DENY_NETS,
read like SWWAF_TRUSTED_PROXIES and empty by default, and checked against
the client's own address before its country is looked up. A client in
SWWAF_ALLOW_NETS skips the country lists and the rate limits and is not
looked up. One in SWWAF_DENY_NETS is refused with 403, logged as denied
and not counted. One in SWWAF_RATE_LIMIT_EXEMPT_NETS is neither counted
nor refused by the rate limits. SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES now
refuses a private, loopback or link-local client unless SWWAF_ALLOW_NETS
lists it.

Judgement call: an address in both SWWAF_ALLOW_NETS and SWWAF_DENY_NETS is let through.
Judgement call: the size and time limits still apply to SWWAF_ALLOW_NETS.

Model: opus-5-5

internal/smallwebwaf/smallwebwaf_test.go

@@ -186,6 +186,9 @@ func wantStartingLine(t *testing.T, line map[string]any, appURL string) {
 		"SWWAF_UPSTREAM_RESPONSE_TIMEOUT":     "30m",
 		"SWWAF_REQUEST_MAX_BYTES":             "100M",
 		"SWWAF_RESPONSE_MAX_BYTES":            "5G",
+		"SWWAF_ALLOW_NETS":                    "",
+		"SWWAF_RATE_LIMIT_EXEMPT_NETS":        "",
+		"SWWAF_DENY_NETS":                     "",
 		"SWWAF_RATE_LIMIT_PER_MINUTE":         "1000",
 		"SWWAF_RATE_LIMIT_PER_HOUR":           "10000",
 		"SWWAF_RATE_LIMIT_PER_DAY":            "50000",