Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -44,10 +44,11 @@ const (
 	// ActionDenied is a request refused because its client is in
 	// SWW_DENY_NETS, in a blocklist while SWW_BLOCKLIST_ACTION is deny,
 	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
-	// SWW_REPUTATION_ACTION is deny.
+	// SWW_REPUTATION_ACTION is deny, or that carries a tag in SWW_TAG_DENY.
 	ActionDenied = "denied"
 
-	// ActionCountryDenied is a request refused for its client's country.
+	// ActionCountryDenied is a request refused because its client's country
+	// is not in SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
 	ActionCountryDenied = "country_denied"
 	// ActionAdmin is a request discriminator answered at one of its own
 	// endpoints, or a question about a path under /_sww/.
@@ -179,6 +180,8 @@ type Line struct {
 	// whose verdict lists it, their keys masked, then abuseipdb when its
 	// score is a hit.
 	Reputation []string `json:"reputation,omitempty"`
+	// Tags are the request's tags, sorted.
+	Tags []string `json:"tags,omitempty"`
 	// Offence is the offence the request was held as, OffenceLimit.
 	Offence string `json:"offence,omitempty"`
 	// BanExpires is when the ban the request made, or was refused under,