Read SWWAF_IPV6_GROUP_PREFIX, SWWAF_MAX_TRACKED_CLIENTS and SWWAF_LOG_LEVEL (closes #112)

The IPv6 group that is one client, the size of the table of clients and
the level of the process's own lines become settings. clientGroup reads
the group length from them, so limits, bans, history, lookups, AbuseIPDB
scores and per-client anomaly counters all follow it; ratelimit.New
takes the table size; the process logger takes the level once the
settings are read, and request lines, written apart from it, are never
held back.

Judgement call: SWWAF_IPV6_GROUP_PREFIX accepts 32 to 128, the issue's example range.

Model: opus-5-5

internal/ratelimit/ratelimit.go

@@ -2,8 +2,9 @@
 // and bytes counted over a minute, an hour and a day, as the "Counting
 // method" section of SPEC.md describes, which tell when a request takes
 // the client over a rate limit or a byte limit, and each client's history
-// since it was first seen. At most 20,000 clients are kept, in memory, and
-// written to clients.json and read from it by the state package.
+// since it was first seen. At most SWWAF_MAX_TRACKED_CLIENTS clients are
+// kept, in memory, and written to clients.json and read from it by the
+// state package.
 package ratelimit
 
 import (
@@ -16,11 +17,6 @@ import (
 	"github.com/hashicorp/golang-lru/v2/simplelru"
 )
 
-// maxClients is how many clients are kept. Past it, the least recently
-// seen client is dropped, with its history, and starts afresh if it comes
-// back.
-const maxClients = 20000
-
 const day = 24 * time.Hour
 
 // The kinds of limits, as the metrics name them.
@@ -150,8 +146,11 @@ type Request struct {
 	RuleBlocked bool
 }
 
-// New returns a Limiter for limits, with no client counted yet.
-func New(limits Limits) *Limiter {
+// New returns a Limiter for limits, with no client counted yet, whose
+// table holds at most maxClients clients (SWWAF_MAX_TRACKED_CLIENTS). Past
+// it, the least recently seen client is dropped, with its history, and
+// starts afresh if it comes back.
+func New(limits Limits, maxClients int) *Limiter {
 	clients, err := simplelru.NewLRU[netip.Prefix, *Client](maxClients, nil)
 	if err != nil {
 		panic(err) // NewLRU fails only for a size below one