AbuseIPDB scores for clients that committed an offence, within a daily budget (closes #105)

With SWWAF_ABUSEIPDB_KEY set, a client whose history counts an offence
(a broken limit, a ban rule's match or a block rule's refusal, counted
by kind) is checked in the background, at most
SWWAF_ABUSEIPDB_DAILY_BUDGET checks a day, the count kept in
reputation.json. A client, an IPv4 address or an IPv6 /64, is checked by
the address it sent from, and its score serves all its addresses. A
score at or over SWWAF_ABUSEIPDB_MIN_SCORE is a hit for
SWWAF_REPUTATION_ACTION, logged as abuseipdb and alerted with its score.
A failure or the used-up budget gives no score and raises
source_failure. The key goes only in the Key header.

Judgement call: the budget's day is UTC; AbuseIPDB documents no reset time.
Judgement call: each check sent spends budget; a minute's pause after a failure.

Model: opus-5-5

internal/reputation/dnsbl.go

@@ -20,16 +20,17 @@ import (
 )
 
 const (
-	// maxVerdicts is how many verdicts are kept. Past it, the one fetched
-	// longest ago is dropped.
+	// maxVerdicts is how many verdicts of the DNSBL zones are kept, and how
+	// many scores of AbuseIPDB. Past it, the one fetched longest ago is
+	// dropped.
 	maxVerdicts = 100000
 	// maxQueries is how many queries may be under way at once. Past it, a
 	// zone is not asked about a client until the client's next request, so
 	// that a swarm of new addresses cannot fill the memory.
 	maxQueries = 1000
 	// failureDelay is how long a zone is not asked again after a query to
-	// it fails, so that a zone refusing queries is not asked on every
-	// request.
+	// it fails, and no client is checked with AbuseIPDB after a check
+	// fails, so that a source refusing them is not asked on every request.
 	failureDelay = time.Minute
 )
 
@@ -261,11 +262,7 @@ func (d *DNSBL) ask(ctx context.Context, q query) {
 
 		// Raised before it is logged, so that the alert is there once the
 		// log line is.
-		d.params.Alerts.Raise(alerts.Alert{
-			Event:  alerts.EventSourceFailure,
-			Reason: failed,
-			Detail: map[string]any{"source": shown, "error": err.Error()},
-		})
+		raiseFailure(d.params.Alerts, failed, shown, err)
 		d.params.ProcessLog.Warn(failed, "zone", shown, "error", err.Error())
 	}
 }