Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/discriminator/coreruleset.go

@@ -17,9 +17,10 @@ import (
 // SWW_WAF_MODE is off or SWW_WAF_EXEMPT_PATHS exempts its path, as
 // pathExempt decides, and notes the rules it matched and its score in the
 // log line, and the rules in the metrics. A score at or over
-// SWW_WAF_ANOMALY_THRESHOLD is a match: it raises the waf_block alert,
-// and in block mode refuses the request with 403, which is an offence its
-// client's history counts. Its figures are the score and the threshold.
+// SWW_WAF_ANOMALY_THRESHOLD is a match: it adds the tag exploitsignature,
+// raises the waf_block alert, and in block mode refuses the request with 403,
+// which is an offence its client's history counts. Its figures are the score
+// and the threshold.
 type coreRuleSet struct{}
 
 func (coreRuleSet) name() string { return "core_rule_set" }
@@ -50,6 +51,7 @@ func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
 		return nil
 	}
 
+	rq.addTag(config.ExploitSignatureTag)
 	rq.alertWAFBlock(result)
 
 	if cfg.WAFMode == config.WAFModeDetect {