Network lists: always allowed, exempt from rate limits, always refused (closes #19)

Adds SWWAF_ALLOW_NETS, SWWAF_RATE_LIMIT_EXEMPT_NETS and SWWAF_DENY_NETS,
read like SWWAF_TRUSTED_PROXIES and empty by default, and checked against
the client's own address before its country is looked up. A client in
SWWAF_ALLOW_NETS skips the country lists and the rate limits and is not
looked up. One in SWWAF_DENY_NETS is refused with 403, logged as denied
and not counted. One in SWWAF_RATE_LIMIT_EXEMPT_NETS is neither counted
nor refused by the rate limits. SWWAF_EXCLUSIVELY_ALLOWED_COUNTRIES now
refuses a private, loopback or link-local client unless SWWAF_ALLOW_NETS
lists it.

Judgement call: an address in both SWWAF_ALLOW_NETS and SWWAF_DENY_NETS is let through.
Judgement call: the size and time limits still apply to SWWAF_ALLOW_NETS.

Model: opus-5-5

internal/proxy/staticlists_test.go

@@ -62,26 +62,6 @@ func TestAllowNetsSkipEveryCheckButTheSizeLimit(t *testing.T) {
 	}
 }
 
-func TestRequestFromAllowNetsIsNotCounted(t *testing.T) {
-	t.Parallel()
-
-	app := startApp(t, func(http.ResponseWriter, *http.Request) {})
-	addr, out := startProxy(t, app.URL, map[string]string{
-		trustedProxies:     trustLocalhost,
-		allowNets:          listedAddr,
-		rateLimitPerMinute: "1",
-	})
-
-	// listedAddr's requests are not counted, so the first request from
-	// unlistedAddr is within the limit of one a minute.
-	wantAnswers(t, addr, out, []sentRequest{
-		{listedAddr, http.StatusOK, requestlog.ActionForward},
-		{listedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusTooManyRequests, requestlog.ActionRateLimited},
-	})
-}
-
 func TestDenyNetsRefuseBeforeTheLookupAndTheBody(t *testing.T) {
 	t.Parallel()
 
@@ -169,9 +149,8 @@ type sentRequest struct {
 	action string
 }
 
-// wantAnswers sends requests to smallwebwaf at addr one after another and
+// wantAnswers sends requests to smallwebwaf at addr in turn, as the first
-// checks each one's answer and log line. They must be the first requests
+// it is sent, and checks each one's answer and log line.
-// smallwebwaf is sent, since the log lines are matched to them in order.
 func wantAnswers(t *testing.T, addr string, out *output, requests []sentRequest) {
 	t.Helper()