Anomaly thresholds: alerts for unusual traffic, nothing refused (closes #101)

SWWAF_ANOMALY_CLIENT_*, _NET_*, _ASN_*, _TOTAL_* and SWWAF_WATCH_* with
SWWAF_WATCH_NETS: requests and bytes per minute and per hour, each off by
default; with all off, nothing is counted. Otherwise every request but the
health check is counted, allow-listed and exempt ones included; a count
over its threshold raises an anomaly alert, with a cooldown per scope. At
most 20,000 counters, kept in alerts.json. A per-AS-number threshold with
lookups off, or a malformed SWWAF_WATCH_NETS, stops the start. A cooldown
that has run out is dropped as the hour ends, whatever it held back; the
hour's summary gives its repeats.

Judgement call: refused requests are counted too.
Judgement call: per-client counters are kept in alerts.json, which SPEC.md does not list.
Judgement call: a request counts for an AS number only if the lookup answered before it ended.

Model: opus-5-5

internal/ratelimit/ratelimit.go

@@ -361,9 +361,7 @@ func (l *Limiter) Load(clients []Client, now time.Time) {
 	for _, c := range clients {
 		for i, w := range l.windows {
 			for _, b := range []*Buckets{c.buckets()[i], c.byteBuckets()[i]} {
-				// The window that ends at now covers neither bucket once it
-				// begins after the bucket under way has ended.
-				if !now.Add(-w.length).Before(b.Start.Add(w.length)) {
+				if b.Passed(now, w.length) {
 					*b = Buckets{}
 				}
 			}
@@ -393,8 +391,8 @@ func (l *Limiter) count(
 	)
 
 	for i, w := range l.windows {
-		requestCounts[i] = requestBuckets[i].add(now, w.length, requests)
-		byteCounts[i] = byteBuckets[i].add(now, w.length, bytes)
+		requestCounts[i] = requestBuckets[i].Add(now, w.length, requests)
+		byteCounts[i] = byteBuckets[i].Add(now, w.length, bytes)
 		limit, byteLimit := percentOf(w.limit, percent), percentOf(w.byteLimit, percent)
 
 		switch {
@@ -460,18 +458,18 @@ func percentOf(limit, percent int64) int64 {
 	return limit/hundred*percent + limit%hundred*percent/hundred
 }
 
-// add counts n requests, or n bytes, at now in a window of length, and
-// returns the client's count in the window that ends at now: what is in
-// the bucket under way, and what is in the bucket before it weighted by
-// how much of that bucket the window still covers. With n zero it counts
-// nothing, and returns the count.
+// Add counts n requests, or n bytes, at now in a window of length, and
+// returns the count in the window that ends at now: what is in the bucket
+// under way, and what is in the bucket before it weighted by how much of
+// that bucket the window still covers. With n zero it counts nothing, and
+// returns the count. The anomaly counters count in Buckets too.
 //
 // Concurrent requests can be counted out of order, so now can be a moment
 // before the bucket under way began; such a request is counted in that
 // bucket. A request dated more than a second before it means the clock
 // was set back, and the buckets start afresh: otherwise the bucket before
 // would keep its full weight until the clock caught up.
-func (b *Buckets) add(now time.Time, length time.Duration, n int64) float64 {
+func (b *Buckets) Add(now time.Time, length time.Duration, n int64) float64 {
 	if now.Before(b.Start.Add(-time.Second)) {
 		*b = Buckets{}
 	}
@@ -496,6 +494,14 @@ func (b *Buckets) add(now time.Time, length time.Duration, n int64) float64 {
 	return float64(b.Previous)*covered + float64(b.Current)
 }
 
+// Passed reports whether the window of length that ends at now covers
+// neither of b's buckets: it begins after the bucket under way has ended.
+// What they hold then counts no more, and a state file read at now drops
+// it.
+func (b *Buckets) Passed(now time.Time, length time.Duration) bool {
+	return !now.Add(-length).Before(b.Start.Add(length))
+}
+
 // add counts a response with status in its class. A status of 0, for
 // nothing sent, is not a response.
 func (r *Responses) add(status int) {