Country allow and deny lists, looked up through GeoJS (closes #44)

SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a
request with 403 before its body is read and before the rate limits count
it, logged as country_denied; every log line gains country. The new
internal/lookup asks GeoJS only while a list is set, one request at a
time carrying up to 200 waiting clients, keeps answers 7 days (at most
100,000), and after a failure waits a second, doubling to five minutes.
Private, loopback and link-local clients have no country and are never
sent. Codes are checked with golang.org/x/text/language.

Deviation from SPEC.md, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE.
Deviation: GeoJS's country endpoint, not geo.json, since only the country is needed.
Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait.
Deviation: go.mod and go.sum hand-written; no make target tidies them.

Model: opus-5-5

internal/proxy/request.go

@@ -103,9 +103,18 @@ func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 
 // check is the one place where a request can be refused once its client
 // is known, before its body is read or anything reaches the app. It
-// returns nil to let the request through. The rate limits come first, so
-// that every request is counted, one refused for its size too.
-func (rq *request) check() *refusal {
+// returns nil to let the request through. The country lists come first,
+// and a request they refuse is not counted for the rate limits; then the
+// rate limits, so that every other request is counted, one refused for
+// its size too. ctx is the request's own context.
+func (rq *request) check(ctx context.Context) *refusal {
+	if rq.countryDenied(ctx) {
+		return &refusal{
+			status: http.StatusForbidden,
+			action: requestlog.ActionCountryDenied,
+		}
+	}
+
 	limitHit := rq.h.limiter.Count(clientGroup(rq.client), rq.start)
 	if limitHit != "" {
 		rq.line.LimitHit = limitHit