Country allow and deny lists, looked up through GeoJS (closes #44)

SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a
request with 403 before its body is read and before the rate limits count
it, logged as country_denied; every log line gains country. The new
internal/lookup asks GeoJS only while a list is set, one request at a
time carrying up to 200 waiting clients, keeps answers 7 days (at most
100,000), and after a failure waits a second, doubling to five minutes.
Private, loopback and link-local clients have no country and are never
sent. Codes are checked with golang.org/x/text/language.

Deviation from SPEC.md, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE.
Deviation: GeoJS's country endpoint, not geo.json, since only the country is needed.
Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait.
Deviation: go.mod and go.sum hand-written; no make target tidies them.

Model: opus-5-5

internal/proxy/proxy.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 )
 
@@ -40,6 +41,9 @@ type Params struct {
 	RequestLog io.Writer
 	// ProcessLog receives the process's own messages.
 	ProcessLog *slog.Logger
+	// GeoJSURL is where clients' countries are looked up, normally
+	// lookup.URL. GeoJS is asked only while a country list is set.
+	GeoJSURL string
 }
 
 // New returns the server smallwebwaf runs: each request it reads passes
@@ -63,6 +67,11 @@ func New(params Params) *http.Server {
 				PerHour:   params.Config.RateLimitPerHour,
 				PerDay:    params.Config.RateLimitPerDay,
 			}),
+			geojs: lookup.New(lookup.Params{
+				URL:        params.GeoJSURL,
+				Now:        time.Now,
+				ProcessLog: params.ProcessLog,
+			}),
 		},
 		ReadHeaderTimeout: params.Config.ClientRequestTimeout,
 		IdleTimeout:       clientIdleTimeout,
@@ -80,6 +89,7 @@ type handler struct {
 	errorLog   *log.Logger
 	transport  http.RoundTripper
 	limiter    *ratelimit.Limiter
+	geojs      *lookup.GeoJS
 }
 
 // newTransport returns what carries requests to the app. It never goes
@@ -101,7 +111,7 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	rq := h.newRequest(w, r)
 	defer rq.finish()
 
-	refused := rq.check()
+	refused := rq.check(r.Context())
 	if refused != nil {
 		rq.answer(*refused)