Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/discriminator/proxy_test.go

@@ -69,7 +69,9 @@ const (
 	lookupDBPath         = "SWW_LOOKUP_DB_PATH"
 	lookupTimeout        = "SWW_LOOKUP_TIMEOUT"
 	addLookupHeaders     = "SWW_ADD_LOOKUP_HEADERS"
-	deniedCountries      = "SWW_DENIED_COUNTRIES"
+	tagDeny              = "SWW_TAG_DENY"
+	// denyKP is the value of SWW_TAG_DENY that refuses fromKP's country.
+	denyKP               = "country=KP"
 	allowedCountries     = "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"
 	banResponse          = "SWW_BAN_RESPONSE"
 	limitBanDuration     = "SWW_LIMIT_BAN_DURATION"