Byte limits per client over a minute, an hour and a day (closes #20)

SWWAF_BYTES_LIMIT_PER_MINUTE, _PER_HOUR and _PER_DAY (10G, 20G, 50G)
and SWWAF_BYTES_COUNT (both). A request's bytes are counted once its
answer has ended, for a request passed to the app that the rate limits
count; what a WebSocket carries each way, once it closes. Bytes over a
limit ban the client as a broken rate limit does, and cut nothing
short. clients.json keeps the byte buckets, the log line's counts carry
the byte totals, ban notes say what the limit is on, and the limit hits
metric is labelled by kind.

Judgement call: limit_hit names a byte window minute_bytes, hour_bytes
or day_bytes, as counts names the byte totals.
Judgement call: in observe mode, the bytes of a request enforce mode
would have refused are not counted.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -45,7 +45,7 @@ const (
 )
 
 // OffenceLimit is the offence a request line names for a request that
-// broke a rate limit.
+// broke a rate limit, or whose bytes broke a byte limit.
 const OffenceLimit = "limit"
 
 // timeLayout is RFC 3339 with milliseconds.
@@ -117,13 +117,16 @@ type Line struct {
 	// ActionBanned, ActionCountryDenied, ActionRateLimited or
 	// ActionRuleBlocked.
 	WouldAction string `json:"would_action,omitempty"`
-	// Counts are the client's requests as the rate limits counted them
-	// with this one, for a request they counted.
+	// Counts are, for a request the rate limits counted, the client's
+	// requests as they counted them with this one, and its bytes as the
+	// byte limits counted them, with this request's once it has ended if
+	// they count them.
 	Counts ratelimit.Counts `json:"counts,omitzero"`
 	// RuleIDs are the ids of the rule file rules the request matched.
 	RuleIDs []string `json:"rule_ids,omitempty"`
-	// LimitHit is the window whose rate limit the request went over:
-	// minute, hour or day.
+	// LimitHit is the window whose limit the request went over, named as
+	// Counts names its count: minute, hour or day for a rate limit, and
+	// minute_bytes, hour_bytes or day_bytes for a byte limit.
 	LimitHit string `json:"limit_hit,omitempty"`
 	// Offence is the offence the request was held as, OffenceLimit.
 	Offence string `json:"offence,omitempty"`