Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/discriminator/heuristics.go

@@ -43,12 +43,15 @@ const (
 // country are looked up, so that a client they refuse is not looked up.
 func beforeLookup() []heuristic {
 	return []heuristic{
+		tagLists{},
 		denyNets{},
 		activeBan{},
 	}
 }
 
 // afterLookup are the heuristics that run once the lookup has been made.
+// tag_deny runs twice: before the rate limits, on the tags known by then, and
+// last, on the tag rule_files and core_rule_set can add.
 func afterLookup() []heuristic {
 	return []heuristic{
 		countries{},
@@ -56,11 +59,13 @@ func afterLookup() []heuristic {
 		crowdSec{},
 		dnsbl{},
 		abuseIPDB{},
+		tagDeny{},
 		rateLimits{},
 		trapPaths{},
 		ruleFiles{},
 		headerLimits{},
 		coreRuleSet{},
+		tagDeny{},
 	}
 }