Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/discriminator/abuseipdb.go

@@ -8,18 +8,20 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// abuseIPDB notes AbuseIPDB, as noteHit does, with the score, when its score
-// of the client is a hit, and refuses the request when SWW_REPUTATION_ACTION
-// is deny, as dnsbl does for a zone. While SWW_ABUSEIPDB_KEY is unset it does
-// nothing. A client without a score is checked in the background, by the
-// request's address, if its history counts an offence, and the request does
-// not wait for the answer. The score is then used for each address of the
-// client. Its figures are the score and SWW_ABUSEIPDB_MIN_SCORE.
+// abuseIPDB adds the tag abuseipdb and notes AbuseIPDB, as noteHit does, with
+// the score, when its score of the client is a hit, and refuses the request
+// when SWW_REPUTATION_ACTION is deny, as dnsbl does for a zone. While
+// SWW_ABUSEIPDB_KEY is unset it does nothing. A client without a score is
+// checked in the background, by the request's address, if its history counts
+// an offence, and the request does not wait for the answer. The score is then
+// used for each address of the client. Its figures are the score and
+// SWW_ABUSEIPDB_MIN_SCORE.
 type abuseIPDB struct{}
 
 func (abuseIPDB) name() string { return "abuseipdb" }
@@ -39,6 +41,7 @@ func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 	}
 
 	rq.abuseIPDBHit = true
+	rq.addTag(config.AbuseIPDBTag)
 	rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
 		"scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE")