Network lists: always allowed, exempt from rate limits, always refused (closes #19)

Adds SWWAF_ALLOW_NETS, SWWAF_RATE_LIMIT_EXEMPT_NETS and SWWAF_DENY_NETS,
read like SWWAF_TRUSTED_PROXIES and empty by default, and checked against
the client's own address before its country is looked up. A client in
SWWAF_ALLOW_NETS skips the country lists and the rate limits and is not
looked up. One in SWWAF_DENY_NETS is refused with 403, logged as denied
and not counted. One in SWWAF_RATE_LIMIT_EXEMPT_NETS is neither counted
nor refused by the rate limits. SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES now
refuses a private, loopback or link-local client unless SWWAF_ALLOW_NETS
lists it.

Judgement call: an address in both SWWAF_ALLOW_NETS and SWWAF_DENY_NETS is let through.
Judgement call: the size and time limits still apply to SWWAF_ALLOW_NETS.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -26,6 +26,9 @@ const (
 	// ActionRateLimited is a request refused because it took its client
 	// over a rate limit, or came while the client was over one.
 	ActionRateLimited = "rate_limited"
+	// ActionDenied is a request refused because its client is in
+	// SWWAF_DENY_NETS.
+	ActionDenied = "denied"
 	// ActionCountryDenied is a request refused for its client's country.
 	ActionCountryDenied = "country_denied"
 	// ActionAdmin is a request smallwebwaf answered at one of its own