Bans an admin makes or lifts: the admin cause, a reason, lifted bans kept (closes #86)

A bans.json entry without a cause gets the cause admin, written back so.
Bans whose cause is admin are never dropped and do not count toward
SWWAF_MAX_BANS, so setting a ban's cause to admin keeps it. Bans
smallwebwaf makes get a reason: the limit broken or the rule matched. A
lifted ban refuses nothing, is kept, and makes no later ban longer.
smallwebwaf_bans_made_total counts admin bans an edit adds while running;
earlier_bans counts admin in place of without_cause.

Judgement call: lifted lifts at once, whatever time it gives.
Judgement call: a lifted ban still counts in earlier_bans.
Known gap: a ban dropped from behind an admin's ban on its netblock leaves that netblock's later earlier_bans.

Model: opus-5-5

internal/proxy/rulefiles_test.go

@@ -55,6 +55,7 @@ func TestEachRuleAction(t *testing.T) {
 		Start:    start,
 		Expires:  start.Add(7 * 24 * time.Hour),
 		Cause:    bans.CauseAttack,
+		Reason:   "matched the rule probe",
 		Notes: bans.Notes{
 			RuleID: "probe",
 			Target: "path",