rproxy passes the app the client's AS number and country by default (closes #379)

SWW_WAF_ADD_LOOKUP_HEADERS now defaults to true, so the app gets
X-Client-ASN and X-Client-Country with no setting. While
SWW_WAF_LOOKUP_SOURCE is off it defaults to false, so turning lookups
off alone still starts; true set with the lookup off still stops the
start. With GeoJS, a new client's first request now waits for its
answer, up to SWW_WAF_ASN_AND_COUNTRY_LOOKUP_TIMEOUT_MS.

Model: opus-5-5

internal/waf/biased_test.go

@@ -387,14 +387,16 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 
 			// In a synctest bubble, as
 			// TestRequestWaitsAsLongAsTheASNAndCountryLookupTimeoutSays says,
-			// with a GeoJS that never answers.
+			// with a GeoJS that never answers. The headers, which need the
+			// answer too, are off.
 			synctest.Test(t, func(t *testing.T) {
 				server, out, _ := newWAF(t, silentGeoJSURL, time.Now,
 					map[string]string{
 						asnAndCountryLookupTimeout: strconv.FormatInt(
 							timeout.Milliseconds(), 10),
-						tagLists:   "vpn=" + vpnList,
-						tc.setting: tc.value,
+						addLookupHeaders: falseValue,
+						tagLists:         "vpn=" + vpnList,
+						tc.setting:       tc.value,
 					})
 				began := time.Now()