Look clients up in the IPinfo Lite file with SWWAF_LOOKUP_SOURCE=file (closes #22)

SWWAF_LOOKUP_SOURCE=file looks every client up in the file
SWWAF_LOOKUP_DB_PATH names, without GeoJS. file without the path, the
path with another source, or a file that cannot be read stops the start.
The file is read whole into memory, so overwriting it in place cannot
disturb a lookup, and read again 2 seconds after its last change; a
replacement that cannot be read is logged, counted and sent as a
file_error alert, and the old one stays in use. Metrics give when it
was read and the failed reads. Tests write their databases through
internal/lookup/lookuptest.

Deviation: go.mod and go.sum written by hand; go runs only through make.
Judgement call: the 2-second wait, as the rule files have.

Model: opus-5-5

internal/lookup/lookup.go

@@ -1,6 +1,7 @@
-// Package lookup looks up each client's AS number and country through
-// the GeoJS web service, and keeps the answers in memory, for at most
-// 100,000 clients and for 7 days each. The answers are written to
+// Package lookup looks up each client's AS number and country, through
+// the GeoJS web service or in the lookup database, the IPinfo Lite file
+// SWWAF_LOOKUP_DB_PATH names. GeoJS's answers are kept in memory, for at
+// most 100,000 clients and for 7 days each, and are written to
 // lookups.json and read from it by the state package.
 package lookup
 
@@ -113,11 +114,12 @@ type GeoJS struct {
 	retryAt    time.Time
 }
 
-// Answer is what GeoJS said about a client, as lookups.json holds it: its
-// AS number, such as AS64496, and the AS's name, both "" when GeoJS knows
-// no AS number for it; its country, "" when GeoJS cannot place it; when
-// GeoJS said so, and when the answer was last used. The zero Answer is
-// that of a client with no answer.
+// Answer is what GeoJS or the lookup database said about a client: its AS
+// number, such as AS64496, and the AS's name, both "" when the source knows
+// no AS number for it; its country, "" when the source cannot place it;
+// when the source said so; and, for GeoJS's answers, which lookups.json
+// holds, when the answer was last used. The zero Answer is that of a
+// client with no answer.
 //
 //nolint:tagliatelle // the state files use snake_case, as the request log does
 type Answer struct {