Per-client request rate limits over a minute, an hour and a day (closes #43)

Each client, one IPv4 address or one IPv6 /64, is counted in two buckets
per window, the earlier weighted by how much of it the window covers; at
most 20,000 clients are kept, least recently seen dropped first. A
request over SWWAF_RATE_LIMIT_PER_MINUTE, _HOUR or _DAY (1000, 10000,
50000, or off) gets 429 before reaching the app. Refused requests count,
413s included. A clock set back over a second behind a bucket's start
restarts that window. The log line gains limit_hit and the action
rate_limited.

Deviation from SPEC.md, per the issue: the 20,000 bound and /64 are fixed.
Judgement call: golang-lru/v2 holds the table; httprate does not count refused requests.
Deviation: go.mod and go.sum hand-written; no make target tidies them.

Model: opus-5-5

internal/proxy/ratelimits_test.go

@@ -0,0 +1,67 @@
+package proxy_test
+
+import (
+	"net/http"
+	"sync/atomic"
+	"testing"
+
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+func TestRateLimitRefusesWith429BeforeTheApp(t *testing.T) {
+	t.Parallel()
+
+	var calls atomic.Int32
+
+	app := startApp(t, func(http.ResponseWriter, *http.Request) {
+		calls.Add(1)
+	})
+	addr, out := startProxy(t, app.URL, map[string]string{
+		trustedProxies:     trustLocalhost,
+		rateLimitPerMinute: "1",
+	})
+
+	const otherClient = "203.0.113.10"
+
+	// With a limit of one request a minute, a client's second request is
+	// refused. A client is one IPv4 address, or one IPv6 /64; an IPv4
+	// address in IPv6 form is that IPv4 address.
+	requests := []struct {
+		client string // as X-Forwarded-For names it
+		logged string // as the log line's client_ip names it
+		want   int
+	}{
+		{client, client, http.StatusOK},
+		{client, client, http.StatusTooManyRequests},
+		{otherClient, otherClient, http.StatusOK},
+		{"::ffff:" + otherClient, otherClient, http.StatusTooManyRequests},
+		{"2001:db8::1", "2001:db8::1", http.StatusOK},
+		{"2001:db8::8000:0:0:1", "2001:db8::8000:0:0:1", http.StatusTooManyRequests},
+		{"2001:db8:0:1::1", "2001:db8:0:1::1", http.StatusOK},
+	}
+
+	for i, sent := range requests {
+		req := newRequest(t, http.MethodGet, addr, "/", http.NoBody)
+		req.Header.Set(forwardedFor, sent.client)
+		wantStatus(t, do(t, req), sent.want)
+
+		line := out.requestLines(t, i+1)[i]
+		if line.ClientIP != sent.logged {
+			t.Errorf("log line has client_ip %q, want %q", line.ClientIP, sent.logged)
+		}
+
+		if sent.want == http.StatusOK {
+			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
+		} else {
+			wantLine(t, line, http.StatusTooManyRequests, requestlog.ActionRateLimited)
+
+			if line.LimitHit != "minute" {
+				t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
+			}
+		}
+	}
+
+	if calls.Load() != 4 {
+		t.Errorf("the app was called %d times, want 4", calls.Load())
+	}
+}