Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/discriminator/proxy_test.go

@@ -69,7 +69,9 @@ const (
 	lookupDBPath         = "SWW_LOOKUP_DB_PATH"
 	lookupTimeout        = "SWW_LOOKUP_TIMEOUT"
 	addLookupHeaders     = "SWW_ADD_LOOKUP_HEADERS"
-	deniedCountries      = "SWW_DENIED_COUNTRIES"
+	tagDeny              = "SWW_TAG_DENY"
+	// denyKP is the value of SWW_TAG_DENY that refuses fromKP's country.
+	denyKP               = "country=KP"
 	allowedCountries     = "SWW_EXCLUSIVELY_ALLOWED_COUNTRIES"
 	banResponse          = "SWW_BAN_RESPONSE"
 	limitBanDuration     = "SWW_LIMIT_BAN_DURATION"