Per-client request rate limits over a minute, an hour and a day (closes #43)

Each client, one IPv4 address or one IPv6 /64, is counted in two buckets
per window, the earlier weighted by how much of it the window covers; at
most 20,000 clients are kept, least recently seen dropped first. A
request over SWWAF_RATE_LIMIT_PER_MINUTE, _HOUR or _DAY (1000, 10000,
50000, or off) gets 429 before reaching the app. Refused requests count,
413s included. A clock set back over a second behind a bucket's start
restarts that window. The log line gains limit_hit and the action
rate_limited.

Deviation from SPEC.md, per the issue: the 20,000 bound and /64 are fixed.
Judgement call: golang-lru/v2 holds the table; httprate does not count refused requests.
Deviation: go.mod and go.sum hand-written; no make target tidies them.

Model: opus-5-5

internal/proxy/client.go

@@ -48,6 +48,21 @@ func clientAddress(
 	return client
 }
 
+// ipv6GroupPrefix is the length of the IPv6 netblock that is one client.
+const ipv6GroupPrefix = 64
+
+// clientGroup is the client a request is counted toward: its IPv4
+// address, or the /64 its IPv6 address is in, since one abuser usually
+// holds a whole /64. An IPv4 address in IPv6 form counts as IPv4.
+func clientGroup(addr netip.Addr) netip.Prefix {
+	addr = addr.Unmap()
+	if addr.Is6() {
+		return netip.PrefixFrom(addr, ipv6GroupPrefix).Masked()
+	}
+
+	return netip.PrefixFrom(addr, addr.BitLen())
+}
+
 // isInside reports whether addr is in one of the netblocks.
 func isInside(addr netip.Addr, netblocks []netip.Prefix) bool {
 	return slices.ContainsFunc(netblocks, func(netblock netip.Prefix) bool {