Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/discriminator/countries_test.go

@@ -33,13 +33,13 @@ func TestCountryLists(t *testing.T) {
 		env     map[string]string
 		refused []string
 	}{
-		{"denied", map[string]string{deniedCountries: "kp"}, []string{fromKP}},
 		{
 			"exclusively allowed", map[string]string{allowedCountries: "DE"},
 			[]string{fromKP, unplaced},
 		},
 		{
-			"both", map[string]string{deniedCountries: "kp", allowedCountries: "de,fr"},
+			"with a country in SWW_TAG_DENY",
+			map[string]string{tagDeny: denyKP, allowedCountries: "de,fr"},
 			[]string{fromKP, unplaced},
 		},
 	} {
@@ -95,12 +95,12 @@ func TestCountryRefusalNamesItsHeuristicCountryAndSetting(t *testing.T) {
 
 	geojsURL, _ := startGeoJS(t)
 	s, _, _ := startWithClock(t, geojsURL, map[string]string{
-		lookupTimeout: "1h", deniedCountries: "kp", allowedCountries: "de",
+		lookupTimeout: "1h", allowedCountries: "de",
 	})
 
 	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionCountryDenied)
 	wantHeuristic(t, line, "countries",
-		`{"country": "KP", "setting": "SWW_DENIED_COUNTRIES"}`)
+		`{"country": "KP", "setting": "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"}`)
 
 	line = s.get(unplaced, http.StatusForbidden, requestlog.ActionCountryDenied)
 	wantHeuristic(t, line, "countries",
@@ -117,9 +117,9 @@ func TestCountryRefusalKeepsARequestFromTheApp(t *testing.T) {
 	})
 	geojsURL, _ := startGeoJS(t)
 	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
-		trustedProxies:  trustLocalhost,
-		lookupTimeout:   "1h",
-		deniedCountries: "kp",
+		trustedProxies:   trustLocalhost,
+		lookupTimeout:    "1h",
+		allowedCountries: "de",
 	})
 
 	req := newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body"))
@@ -202,7 +202,7 @@ func TestPrivateAddressIsNeverLookedUp(t *testing.T) {
 		env  map[string]string
 	}{
 		{"no setting needs the lookup", nil},
-		{"a country list is set", map[string]string{deniedCountries: "kp"}},
+		{"a tag setting needs it", map[string]string{tagDeny: denyKP}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()