AbuseIPDB scores for clients that committed an offence, within a daily budget (closes #105)

With SWWAF_ABUSEIPDB_KEY set, a client whose history counts an offence
(a broken limit, a ban rule's match or a block rule's refusal, counted
by kind) is checked in the background, at most
SWWAF_ABUSEIPDB_DAILY_BUDGET checks a day, the count kept in
reputation.json. A client, an IPv4 address or an IPv6 /64, is checked by
the address it sent from, and its score serves all its addresses. A
score at or over SWWAF_ABUSEIPDB_MIN_SCORE is a hit for
SWWAF_REPUTATION_ACTION, logged as abuseipdb and alerted with its score.
A failure or the used-up budget gives no score and raises
source_failure. The key goes only in the Key header.

Judgement call: the budget's day is UTC; AbuseIPDB documents no reset time.
Judgement call: each check sent spends budget; a minute's pause after a failure.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -36,7 +36,8 @@ const (
 	ActionRuleBlocked = "rule_blocked"
 	// ActionDenied is a request refused because its client is in
 	// SWWAF_DENY_NETS, in a blocklist while SWWAF_BLOCKLIST_ACTION is deny,
-	// or listed by a DNSBL zone while SWWAF_REPUTATION_ACTION is deny.
+	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
+	// SWWAF_REPUTATION_ACTION is deny.
 	ActionDenied = "denied"
 	// ActionCountryDenied is a request refused for its client's country.
 	ActionCountryDenied = "country_denied"
@@ -139,7 +140,8 @@ type Line struct {
 	// minute_bytes, hour_bytes or day_bytes for a byte limit.
 	LimitHit string `json:"limit_hit,omitempty"`
 	// Reputation are the URLs of the blocklists that list the client, then
-	// the DNSBL zones whose verdict lists it, their keys masked.
+	// the DNSBL zones whose verdict lists it, their keys masked, then
+	// abuseipdb when its score is a hit.
 	Reputation []string `json:"reputation,omitempty"`
 	// Offence is the offence the request was held as, OffenceLimit.
 	Offence string `json:"offence,omitempty"`