Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/reputation/reputation.go

@@ -1,7 +1,8 @@
 // Package reputation fetches the lists the settings name by URL: the
 // blocklists of SWW_BLOCKLIST_URLS, the file of AS:percent lines
-// SWW_ASN_LIMIT_PERCENT_URL names, and the decision list of the CrowdSec
-// engine SWW_CROWDSEC_LAPI_URL names. It keeps the last good copy of
+// SWW_ASN_LIMIT_PERCENT_URL names, the address lists of SWW_TAG_LISTS, and
+// the decision list of the CrowdSec engine SWW_CROWDSEC_LAPI_URL names. It
+// keeps the last good copy of
 // each, whole, comment lines included, which is used while a fetch fails,
 // and when each was last tried. It also asks the DNSBL zones of
 // SWW_DNSBL_ZONES about clients, and keeps their verdicts, and checks
@@ -71,6 +72,8 @@ type Params struct {
 	// (SWW_ASN_LIMIT_PERCENT_URL), "" while it is unset.
 	BlocklistURLs      []string
 	ASNLimitPercentURL string
+	// TagLists are the address lists that add a tag (SWW_TAG_LISTS).
+	TagLists []config.TagList
 	// CrowdSecDecisionsURL is the CrowdSec decision list, "" while
 	// SWW_CROWDSEC_LAPI_URL is unset, fetched with CrowdSecKey
 	// (SWW_CROWDSEC_LAPI_KEY).
@@ -112,11 +115,11 @@ type list struct {
 	failures int
 }
 
-// entries are what the lines of a copy say: for a blocklist, the netblocks
-// it names, with the lengths among them, for the file of AS:percent lines,
-// the percentage it gives each AS number, and for the CrowdSec decision
-// list, the decision on each netblock that ends last, with the lengths
-// among them.
+// entries are what the lines of a copy say: for a blocklist or a tag list, the
+// netblocks it names, with the lengths among them, for the file of AS:percent
+// lines, the percentage it gives each AS number, and for the CrowdSec decision
+// list, the decision on each netblock that ends last, with the lengths among
+// them.
 type entries struct {
 	netblocks map[netip.Prefix]bool
 	lengths   []int
@@ -152,14 +155,18 @@ func New(params Params) *Lists {
 }
 
 // URLs returns the URL of every list: the blocklists' in the order
-// SWW_BLOCKLIST_URLS names them, then SWW_ASN_LIMIT_PERCENT_URL, then
-// the CrowdSec decision list's.
+// SWW_BLOCKLIST_URLS names them, then SWW_ASN_LIMIT_PERCENT_URL, then the
+// tag lists', then the CrowdSec decision list's.
 func (l *Lists) URLs() []string {
 	urls := slices.Clone(l.params.BlocklistURLs)
 	if l.params.ASNLimitPercentURL != "" {
 		urls = append(urls, l.params.ASNLimitPercentURL)
 	}
 
+	for _, list := range l.params.TagLists {
+		urls = append(urls, list.URL)
+	}
+
 	if l.params.CrowdSecDecisionsURL != "" {
 		urls = append(urls, l.params.CrowdSecDecisionsURL)
 	}
@@ -184,6 +191,22 @@ func (l *Lists) ListedBy(addr netip.Addr) []string {
 	return listedBy
 }
 
+// TagsOf returns the names of the tag lists whose copy holds addr.
+func (l *Lists) TagsOf(addr netip.Addr) []string {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	var names []string
+
+	for _, list := range l.params.TagLists {
+		if l.lists[list.URL].entries.contain(addr) {
+			names = append(names, list.Name)
+		}
+	}
+
+	return names
+}
+
 // ASNLimitPercent returns the percentage the copy of the file of
 // AS:percent lines gives asn, and whether it lists asn.
 func (l *Lists) ASNLimitPercent(asn string) (int64, bool) {
@@ -481,10 +504,10 @@ func (l *Lists) get(ctx context.Context, listURL string) ([]string, error) {
 }
 
 // parse reads the lines of the list at listURL, fetched at fetched: those
-// of a blocklist, of the file of AS:percent lines, or of the CrowdSec
-// decision list. In the first two, anything after a ; or a # on a line is
-// left out, and so is a line left blank. Any other line that does not read
-// is an error naming it by its number.
+// of a blocklist or a tag list, of the file of AS:percent lines, or of the
+// CrowdSec decision list. In all but the decision list, anything after a ; or
+// a # on a line is left out, and so is a line left blank. Any other line that
+// does not read is an error naming it by its number.
 func (l *Lists) parse(
 	listURL string, lines []string, fetched time.Time,
 ) (entries, error) {
@@ -498,8 +521,8 @@ func (l *Lists) parse(
 	}
 }
 
-// parseNetblocks reads a blocklist's lines, each an address or a netblock
-// as the settings take them.
+// parseNetblocks reads the lines of a blocklist or a tag list, each an address
+// or a netblock as the settings take them.
 func parseNetblocks(lines []string) (entries, error) {
 	found := entries{netblocks: map[netip.Prefix]bool{}}
 
@@ -551,7 +574,7 @@ func parseNetblock(text string) (netip.Prefix, bool) {
 }
 
 // parsePercents reads the lines of the file of AS:percent lines, each an
-// AS number, : and a percentage, as SWW_ASN_LIMIT_PERCENT takes them. An
+// AS number, : and a percentage, such as AS64496:50. An
 // AS number listed more than once gets the lowest of its percentages.
 func parsePercents(lines []string) (entries, error) {
 	found := entries{percents: map[string]int64{}}