Per-client request rate limits over a minute, an hour and a day (closes #43)

Each client, one IPv4 address or one IPv6 /64, is counted in two buckets
per window, the earlier weighted by how much of it the window covers; at
most 20,000 clients are kept, least recently seen dropped first. A
request over SWWAF_RATE_LIMIT_PER_MINUTE, _HOUR or _DAY (1000, 10000,
50000, or off) gets 429 before reaching the app. Refused requests count,
413s included. A clock set back over a second behind a bucket's start
restarts that window. The log line gains limit_hit and the action
rate_limited.

Deviation from SPEC.md, per the issue: the 20,000 bound and /64 are fixed.
Judgement call: golang-lru/v2 holds the table; httprate does not count refused requests.
Deviation: go.mod and go.sum hand-written; no make target tidies them.

Model: opus-5-5

internal/proxy/proxy.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 )
 
 // The request line and headers a client may send, and how long a
@@ -57,6 +58,11 @@ func New(params Params) *http.Server {
 			processLog: params.ProcessLog,
 			errorLog:   errorLog,
 			transport:  newTransport(),
+			limiter: ratelimit.New(ratelimit.Limits{
+				PerMinute: params.Config.RateLimitPerMinute,
+				PerHour:   params.Config.RateLimitPerHour,
+				PerDay:    params.Config.RateLimitPerDay,
+			}),
 		},
 		ReadHeaderTimeout: params.Config.ClientRequestTimeout,
 		IdleTimeout:       clientIdleTimeout,
@@ -73,6 +79,7 @@ type handler struct {
 	processLog *slog.Logger
 	errorLog   *log.Logger
 	transport  http.RoundTripper
+	limiter    *ratelimit.Limiter
 }
 
 // newTransport returns what carries requests to the app. It never goes