Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/discriminator/staticlists_test.go

@@ -32,13 +32,12 @@ func TestAllowNetsSkipEveryCheck(t *testing.T) {
 		trustedProxies:     trustLocalhost,
 		allowNets:          "198.51.100.0/24",
 		denyNets:           fromKP,
-		deniedCountries:    "kp",
+		tagDeny:            denyKP,
 		rateLimitPerMinute: "1",
 	})
 
-	// Neither SWW_DENY_NETS, the country lists nor the limit of one
-	// request a minute refuses the client, and its country is not looked
-	// up.
+	// Neither SWW_DENY_NETS, SWW_TAG_DENY nor the limit of one request a
+	// minute refuses the client, and its country is not looked up.
 	wantAnswers(t, addr, out, []sentRequest{
 		{fromKP, http.StatusOK, requestlog.ActionForward},
 		{fromKP, http.StatusOK, requestlog.ActionForward},
@@ -83,9 +82,9 @@ func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
 	})
 	geojsURL, asked := startGeoJS(t)
 	addr, out := startProxyWithGeoJS(t, app.URL, geojsURL, map[string]string{
-		trustedProxies:  trustLocalhost,
-		denyNets:        "203.0.113.0/24",
-		deniedCountries: "kp",
+		trustedProxies: trustLocalhost,
+		denyNets:       "203.0.113.0/24",
+		tagDeny:        denyKP,
 	})
 
 	req := newRequest(t, http.MethodPost, addr, "/", strings.NewReader("a body"))
@@ -142,19 +141,19 @@ func TestRateLimitExemptNetsAreNeitherCountedNorRefused(t *testing.T) {
 		trustedProxies:      trustLocalhost,
 		lookupTimeout:       "1h",
 		rateLimitExemptNets: listedAddr + "," + fromKP,
-		deniedCountries:     "kp",
+		tagDeny:             denyKP,
 		rateLimitPerMinute:  "1",
 	})
 
 	// listedAddr's requests are neither refused nor counted, so the first
-	// request from unlistedAddr is within the limit of one a minute. The
-	// country lists still refuse an exempt client.
+	// request from unlistedAddr is within the limit of one a minute.
+	// SWW_TAG_DENY still refuses an exempt client.
 	wantAnswers(t, addr, out, []sentRequest{
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
-		{fromKP, http.StatusForbidden, requestlog.ActionCountryDenied},
+		{fromKP, http.StatusForbidden, requestlog.ActionDenied},
 	})
 }