Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/discriminator/proxy.go

@@ -155,11 +155,12 @@ func newHandler(params Params) *handler {
 	h.geojs = lookup.New(lookup.Params{
 		URL:     params.GeoJSURL,
 		Timeout: params.Config.LookupTimeout,
-		// The country lists, the headers and the biased thresholds act on
-		// the answer before the request goes on.
-		Wait: len(params.Config.DeniedCountries) > 0 ||
-			len(params.Config.ExclusivelyAllowedCountries) > 0 ||
-			params.Config.AddLookupHeaders || biasedThresholdsSet(params.Config),
+		// The country list, the headers, the tag settings that name an asn=
+		// or country= tag and the biased thresholds act on the answer before
+		// the request goes on.
+		Wait: len(params.Config.ExclusivelyAllowedCountries) > 0 ||
+			params.Config.AddLookupHeaders || params.Config.TagsNeedLookup() ||
+			biasedThresholdsSet(params.Config),
 		Answered:   h.addLookup,
 		Now:        params.Now,
 		ProcessLog: params.ProcessLog,
@@ -183,6 +184,7 @@ func newReputation(
 	lists := reputation.New(reputation.Params{
 		BlocklistURLs: cfg.BlocklistURLs, Refresh: cfg.BlocklistRefresh,
 		ASNLimitPercentURL:   cfg.ASNLimitPercentURL,
+		TagLists:             cfg.TagLists,
 		CrowdSecDecisionsURL: cfg.CrowdSecDecisionsURL, CrowdSecKey: cfg.CrowdSecKey,
 		Now: params.Now, ProcessLog: params.ProcessLog, Alerts: params.Alerts,
 	})