Request tags, with refusing and limits per tag (closes #175)

Each request gets tags, logged as `tags`: `asn=`, `country=`, one per `SWW_TAG_LISTS` list holding the client, `crowdsec`, `dnsbl=<zone>`, `abuseipdb` and `exploitsignature`. `SWW_TAG_DENY` refuses by tag and `SWW_TAG_LIMIT_PERCENT` lowers limits by tag. They replace `SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and `SWW_DENIED_COUNTRIES`, with no aliases. A tag in those settings that nothing configured can give stops the start.

Judgement call: `SWW_ASN_LIMIT_PERCENT_URL` stays, its entries counting like `asn=` tags.
Judgement call: `SWW_TAG_LIMIT_PERCENT` also lowers byte limits, as the settings it replaces did.
Trips a reader: `sww_country_list_refusals_total` now counts only `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES` refusals.

Model: opus-5-5

internal/sww/sww_test.go

@@ -611,14 +611,14 @@ func TestLookupDatabaseReplacedWhileRunningTakesEffect(t *testing.T) {
 	writeLookupDatabase(t, path, "DE")
 
 	env := map[string]string{
-		listenAddr:             localhost + ":0",
-		stateDir:               t.TempDir(),
-		rulesDir:               t.TempDir(),
-		metricsToken:           token,
-		instanceName:           instance,
-		lookupSource:           "file",
-		lookupDBPath:           path,
-		"SWW_DENIED_COUNTRIES": "kp",
+		listenAddr:     localhost + ":0",
+		stateDir:       t.TempDir(),
+		rulesDir:       t.TempDir(),
+		metricsToken:   token,
+		instanceName:   instance,
+		lookupSource:   "file",
+		lookupDBPath:   path,
+		"SWW_TAG_DENY": "country=KP",
 		// The requests sent until a replacement takes effect, and those
 		// for the metrics, must not break a rate limit, whose ban would
 		// refuse them too.
@@ -1280,7 +1280,7 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 		"SWW_RATE_LIMIT_PER_HOUR":           "1500",
 		rateLimitPerDay:                     "6000",
 		"SWW_RATE_LIMIT_EXEMPT_PATHS":       "",
-		"SWW_DENIED_COUNTRIES":              "",
+		"SWW_TAG_DENY":                      "",
 		"SWW_EXCLUSIVELY_ALLOWED_COUNTRIES": "",
 		"SWW_BAN_RESPONSE":                  "403",
 		"SWW_LIMIT_BAN_DURATION":            "1h",