Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/discriminator/request.go

@@ -138,6 +138,15 @@ func (h *handler) startRequest(
 	return rq
 }
 
+// addTag adds tag to the request's tags, which stay sorted and hold each tag
+// once.
+func (rq *request) addTag(tag string) {
+	at, found := slices.BinarySearch(rq.line.Tags, tag)
+	if !found {
+		rq.line.Tags = slices.Insert(rq.line.Tags, at, tag)
+	}
+}
+
 // requestHeaders returns the headers of r that names lists, by name in
 // lower case, each with its values joined by ", ". Authorization, Cookie
 // and Set-Cookie are never among them, whatever names says.