Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/discriminator/abuseipdb.go

@@ -8,18 +8,20 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/config"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
-// abuseIPDB notes AbuseIPDB, as noteHit does, with the score, when its score
-// of the client is a hit, and refuses the request when SWW_REPUTATION_ACTION
-// is deny, as dnsbl does for a zone. While SWW_ABUSEIPDB_KEY is unset it does
-// nothing. A client without a score is checked in the background, by the
-// request's address, if its history counts an offence, and the request does
-// not wait for the answer. The score is then used for each address of the
-// client. Its figures are the score and SWW_ABUSEIPDB_MIN_SCORE.
+// abuseIPDB adds the tag abuseipdb and notes AbuseIPDB, as noteHit does, with
+// the score, when its score of the client is a hit, and refuses the request
+// when SWW_REPUTATION_ACTION is deny, as dnsbl does for a zone. While
+// SWW_ABUSEIPDB_KEY is unset it does nothing. A client without a score is
+// checked in the background, by the request's address, if its history counts
+// an offence, and the request does not wait for the answer. The score is then
+// used for each address of the client. Its figures are the score and
+// SWW_ABUSEIPDB_MIN_SCORE.
 type abuseIPDB struct{}
 
 func (abuseIPDB) name() string { return "abuseipdb" }
@@ -39,6 +41,7 @@ func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 	}
 
 	rq.abuseIPDBHit = true
+	rq.addTag(config.AbuseIPDBTag)
 	rq.noteHit(bans.ReputationHit{Source: reputation.AbuseIPDBSource, Score: &score},
 		"scored by AbuseIPDB at or over SWW_ABUSEIPDB_MIN_SCORE")