Per-client request rate limits over a minute, an hour and a day (closes #43)

Each client, one IPv4 address or one IPv6 /64, has its requests counted
in two buckets per window, the earlier weighted by how much of it the
window still covers, in a table of at most 20,000 clients that drops the
least recently seen. A request over SWWAF_RATE_LIMIT_PER_MINUTE, _HOUR or
_DAY (1000, 10000, 50000, or off) gets 429 before anything reaches the
app, and refused requests count. The log line gains limit_hit and the
action rate_limited. The rate limits run before the announced-size
check, so a request refused with 413 is counted too.

Deviation from SPEC.md, per the issue: the 20,000 bound and the /64 are fixed, not settings.
Judgement call: golang-lru/v2 holds the table; httprate is not used, as it reads the wall clock and does not count refused requests.
Deviation: go.mod and go.sum were written by hand from the Go checksum database, as no make target runs go mod tidy.

Model: opus-5-5

internal/proxy/ratelimits_test.go

@@ -0,0 +1,62 @@
+package proxy_test
+
+import (
+	"net/http"
+	"sync/atomic"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+func TestRateLimitRefusesWith429BeforeTheApp(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		calls.Add(1)
+	})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		rateLimitPerMinute: "1",
+	})
+
+	// With a limit of one request a minute, a client's second request is
+	// refused. A client is one IPv4 address, or one IPv6 /64.
+	requests := []struct {
+		client string
+		want   int
+	}{
+		{client, http.StatusOK},
+		{client, http.StatusTooManyRequests},
+		{"203.0.113.10", http.StatusOK},
+		{"2001:db8::1", http.StatusOK},
+		{"2001:db8::ffff:2", http.StatusTooManyRequests},
+		{"2001:db8:0:1::1", http.StatusOK},
+	}
+
+	for i, sent := range requests {
+		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+		req.Header.Set(forwardedFor, sent.client)
+		wantStatus(t, do(t, req), sent.want)
+
+		line := out.requestLines(t, i+1)[i]
+		if line.ClientIP != sent.client {
+			t.Errorf("log line has client_ip %q, want %q", line.ClientIP, sent.client)
+		}
+
+		if sent.want == http.StatusOK {
+			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+		} else {
+			wantLine(t, line, http.StatusTooManyRequests, requestlog.ActionRateLimited)
+
+			if line.LimitHit != "minute" {
+				t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
+			}
+		}
+	}
+
+	if calls.Load() != 4 {
+		t.Errorf("the app was called %d times, want 4", calls.Load())
+	}
+}