Country allow and deny lists, looked up through GeoJS (closes #44)

SWWAF_DENIED_COUNTRIES and SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES refuse a
request with 403 before its body is read and before the rate limits count
it, logged as country_denied; every log line gains country. The new
internal/lookup asks GeoJS only while a list is set, one request at a
time carrying up to 200 waiting clients, keeps answers 7 days (at most
100,000), and after a failure waits a second, doubling to five minutes.
Private, loopback and link-local clients have no country and are never
sent. Codes are checked with golang.org/x/text/language.

Deviation from SPEC.md, per the issue: no SWWAF_LOOKUP_SOURCE or SWWAF_LOOKUP_TIMEOUT; 403, not SWWAF_BAN_RESPONSE.
Deviation: GeoJS's country endpoint, not geo.json, since only the country is needed.
Judgement call: an IPv6 /64 is asked about by its first address; at most 10,000 clients wait.
Deviation: go.mod and go.sum hand-written; no make target tidies them.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -26,6 +26,8 @@ const (
 	// ActionRateLimited is a request refused because it took its client
 	// over a rate limit, or came while the client was over one.
 	ActionRateLimited = "rate_limited"
+	// ActionCountryDenied is a request refused for its client's country.
+	ActionCountryDenied = "country_denied"
 )
 
 // timeLayout is RFC 3339 with milliseconds.
@@ -40,6 +42,7 @@ type Line struct {
 	Time           string `json:"time"`
 	ClientIP       string `json:"client_ip"`
 	PeerIP         string `json:"peer_ip"`
+	Country        string `json:"country"`
 	Method         string `json:"method"`
 	Host           string `json:"host"`
 	Path           string `json:"path"`