Caches of outside APIs live in /var/cache/sww (closes #314)

Every cache of answers from an outside service has its own file in `SWW_CACHE_DIR` (default `/var/cache/sww`): `lookups.json` (GeoJS), `lists.json` (lists fetched by URL, CrowdSec's decisions included), `dnsbl.json`, `abuseipdb-scores.json` and `routewatch.json` (at most 100,000 answers, each kept an hour). `reputation.json` is gone; the AbuseIPDB checks spent today stay in `SWW_STATE_DIR` as `abuseipdb-checks-spent.json`, since losing them would spend the daily budget twice.

A cache file never stops the start: one that does not parse is set aside as `<name>.bad` with a `file_error` alert. An unwritable `SWW_CACHE_DIR` stops the start. The `run` script creates the cache directory and gives it to `sww`. The cache directory needs no volume and can be left out of backups.

Model: opus-5-5

script/run

@@ -6,8 +6,9 @@
 # waf listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and
 # rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
 # SWW_STATE_DIR is set, the state files go in bin/state, beside the binary,
-# and unless SWW_RULES_DIR is set, the rule files are those of share/rules.d,
-# which the image ships.
+# and unless SWW_CACHE_DIR is set, the cache files go in bin/cache. Unless
+# SWW_RULES_DIR is set, the rule files are those of share/rules.d, which the
+# image ships.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -31,6 +32,11 @@ main() {
         export SWW_STATE_DIR
         mkdir -p "$SWW_STATE_DIR"
     fi
+    if [ -z "${SWW_CACHE_DIR+set}" ]; then
+        SWW_CACHE_DIR="$ROOT/bin/cache"
+        export SWW_CACHE_DIR
+        mkdir -p "$SWW_CACHE_DIR"
+    fi
     if [ -z "${SWW_RULES_DIR+set}" ]; then
         SWW_RULES_DIR="$ROOT/share/rules.d"
         export SWW_RULES_DIR