Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/metrics/busiest.go

@@ -25,7 +25,7 @@ type busiest struct {
 	requests      *prometheus.CounterVec
 	requestBytes  *prometheus.CounterVec
 	responseBytes *prometheus.CounterVec
-	// refused are, by country, the requests the country lists refused; nil
+	// refused are, by country, the requests the country list refused; nil
 	// by AS number.
 	refused *prometheus.CounterVec
 
@@ -42,7 +42,7 @@ type busiest struct {
 func newCountries(topN int) *busiest {
 	countries := newBusiest(topN, "country", "the client's country")
 	countries.refused = counterVec("sww_country_list_refusals_total",
-		"Requests the country lists refused, by the client's country.",
+		"Requests SWW_EXCLUSIVELY_ALLOWED_COUNTRIES refused, by the client's country.",
 		[]string{"country"})
 
 	return countries
@@ -88,7 +88,7 @@ func (b *busiest) Collect(ch chan<- prometheus.Metric) {
 }
 
 // vecs returns the metrics: by AS number, those of requests and bytes; by
-// country, the refusals by the country lists as well.
+// country, the refusals by the country list as well.
 func (b *busiest) vecs() []*prometheus.CounterVec {
 	vecs := []*prometheus.CounterVec{b.requests, b.requestBytes, b.responseBytes}
 	if b.refused != nil {