servewaf answers rproxy's question about each request and takes its report (closes #170)

`smallwebwaf servewaf` runs today's checks on the visitor's request a
question carries and answers allow, deny or close, instead of passing it
to an app. rproxy's report then counts the bytes toward the byte limits
and adds the request to the client's history. SPEC.md gives the exact
question, answer and report, which rproxy follows. `smallwebwaf` with no
command is unchanged.

Judgement call: a third disposition, close, since closing the question's
connection would read as servewaf down and let the request through.
Judgement call: allow can answer a new request id, since a visitor behind
a trusted proxy can choose its own.

Model: opus-5-5

internal/anomaly/anomaly.go

@@ -103,6 +103,8 @@ type Counter struct {
 
 // Request is a request that has ended, as the counters count it.
 type Request struct {
+	// Host is the site the alert names, "" for none.
+	Host string
 	// Client is the client's address, and ClientGroup the client it is
 	// counted as: its IPv4 address, or the IPv6 netblock of
 	// SWWAF_IPV6_GROUP_PREFIX its address is in.
@@ -396,6 +398,7 @@ func alertFor(r Request, k key, o overThreshold) alerts.Alert {
 
 	return alerts.Alert{
 		Event:    alerts.EventAnomaly,
+		Host:     r.Host,
 		Client:   r.Client,
 		Netblock: k.netblock,
 		ASN:      r.ASN,