Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/discriminator/dnsbl.go

@@ -5,13 +5,16 @@ package discriminator
 
 import (
 	"context"
+	"strings"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
 // dnsbl notes the DNSBL zones whose verdict lists the client, as noteListed
-// does, and refuses the request when SWW_REPUTATION_ACTION is deny. Being
+// does, adds the tag dnsbl=<zone> for each, the zone's key masked, and refuses
+// the request when SWW_REPUTATION_ACTION is deny. Being
 // limit, it lowers the client's limits instead (see limitPercentages), and
 // being log, it does nothing more. A zone without a verdict on the client is
 // asked about it in the background, and the request does not wait for the
@@ -25,6 +28,10 @@ func (dnsbl) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 	rq.dnsblListed = len(listedBy) > 0
 	rq.noteListed(listedBy, "listed by a DNSBL zone")
 
+	for _, zone := range listedBy {
+		rq.addTag(config.DNSBLTagPrefix + strings.ToLower(zone))
+	}
+
 	if !rq.dnsblListed || rq.h.config.ReputationAction != deny {
 		return nil
 	}