Per-client request rate limits over a minute, an hour and a day (closes #43)

Each client, one IPv4 address or one IPv6 /64, has its requests counted
in two buckets per window, the earlier weighted by how much of it the
window still covers, in a table of at most 20,000 clients that drops the
least recently seen. A request over SWWAF_RATE_LIMIT_PER_MINUTE, _HOUR or
_DAY (1000, 10000, 50000, or off) gets 429 before anything reaches the
app, and refused requests count. The log line gains limit_hit and the
action rate_limited. The rate limits run before the announced-size
check, so a request refused with 413 is counted too.

Deviation from SPEC.md, per the issue: the 20,000 bound and the /64 are fixed, not settings.
Judgement call: golang-lru/v2 holds the table; httprate is not used, as it reads the wall clock and does not count refused requests.
Deviation: go.mod and go.sum were written by hand from the Go checksum database, as no make target runs go mod tidy.

Model: opus-5-5

internal/proxy/request.go

@@ -38,6 +38,7 @@ type request struct {
 	body *requestBody // nil for a request without a body
 	line requestlog.Line
 
+	client      netip.Addr
 	peer        netip.Addr
 	peerTrusted bool
 	start       time.Time
@@ -75,6 +76,7 @@ func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 		in:          r,
 		rc:          http.NewResponseController(w),
 		out:         &responseWriter{ResponseWriter: w},
+		client:      client,
 		peer:        peer,
 		peerTrusted: isInside(peer, trusted),
 		start:       start,
@@ -100,10 +102,20 @@ func (h *handler) newRequest(w http.ResponseWriter, r *http.Request) *request {
 }
 
 // check is the one place where a request can be refused once its client
-// is known, before its body is read or anything reaches the app; the rate
-// limits and country lists of milestone 2 go here. It returns nil to let
-// the request through.
+// is known, before its body is read or anything reaches the app. It
+// returns nil to let the request through. The rate limits come first, so
+// that every request is counted, one refused for its size too.
 func (rq *request) check() *refusal {
+	limitHit := rq.h.limiter.Count(clientGroup(rq.client), rq.start)
+	if limitHit != "" {
+		rq.line.LimitHit = limitHit
+
+		return &refusal{
+			status: http.StatusTooManyRequests,
+			action: requestlog.ActionRateLimited,
+		}
+	}
+
 	maxBytes := rq.h.config.RequestMaxBytes
 	if maxBytes > 0 && rq.in.ContentLength > maxBytes {
 		return &refusal{