DNS blocklists asked in the background, verdicts kept (closes #104)

Zones in SWWAF_DNSBL_ZONES are asked about each client (RFC 5782 names)
in the background, through the host's resolver or SWWAF_DNSBL_RESOLVER;
no request waits. Verdicts last SWWAF_REPUTATION_CACHE_TTL and are kept
in reputation.json, at most 100,000. After the blocklists,
SWWAF_REPUTATION_ACTION (limit:25) denies, limits or logs a listed
client; the log line names the zones, each raises reputation_hit, with
metrics by zone. A failed, timed-out or refused query gives no verdict,
raises source_failure, and pauses the zone a minute.

Judgement call: answers in 127.255.255.0/24 or outside 127.0.0.0/8 are failures.
Judgement call: the minute's pause after a failure; at most 1,000 queries at once.
Rule suppressed: paralleltest on the DNSBL tests (Go's resolver shares state across synctest bubbles), funlen on the test of every logged setting.

Model: opus-5-5

internal/alerts/alerts.go

@@ -46,10 +46,11 @@ const (
 	EventAnomaly = "anomaly"
 	// EventWAFBlock comes with the Core Rule Set; nothing raises it yet.
 	EventWAFBlock = "waf_block"
-	// EventReputationHit is a request whose client a blocklist lists.
+	// EventReputationHit is a request whose client a blocklist or a DNSBL
+	// zone lists.
 	EventReputationHit = "reputation_hit"
-	// EventSourceFailure is GeoJS failing or refusing smallwebwaf, or a
-	// fetch of a list failing.
+	// EventSourceFailure is GeoJS failing or refusing smallwebwaf, a fetch
+	// of a list failing, or a query to a DNSBL zone failing or refused.
 	EventSourceFailure = "source_failure"
 	// EventFileError is a rule file or state file edited while smallwebwaf
 	// runs that does not parse, a replacement of the lookup database that