Request tags, with refusing and limits per tag (closes #175)

Each request gets sorted tags from the lookup, new address lists, the
reputation sources and the rule matches, logged as `tags`. New settings:
`SWW_TAG_LISTS`, `SWW_TAG_DENY`, `SWW_TAG_LIMIT_PERCENT`. They replace
`SWW_ASN_LIMIT_PERCENT`, `SWW_COUNTRY_LIMIT_PERCENT` and
`SWW_DENIED_COUNTRIES`. New heuristics `tag_lists` and `tag_deny`; the
latter runs before the rate limits and again after the Core Rule Set.

Model: opus-5-5

internal/config/config.go

@@ -2053,7 +2053,7 @@ func parseTagPercents(value string) (map[string]int64, error) {
 
 		percent, err := strconv.ParseInt(item[colon+1:], 10, 64)
 		if err != nil || percent < 1 || percent > 99 {
-			return nil, fmt.Errorf("%q %w", item[colon+1:], errNotTagPercent)
+			return nil, fmt.Errorf("%q %w", MaskZoneKey(item[colon+1:]), errNotTagPercent)
 		}
 
 		if tag == ExploitSignatureTag {

internal/config/config_test.go

@@ -1480,6 +1480,10 @@ func TestErrorOfATagSettingLeavesOutAZoneKey(t *testing.T) {
 			`"` + spamhausMasked + `" is not a tag, : and a percentage, ` +
 				"such as vpn:50 or asn=14061:25",
 		},
+		{
+			tagLimitPercent, "50:" + tag,
+			`"` + spamhausMasked + `" is not a percentage from 1 to 99`,
+		},
 		{tagLimitPercent, tag + ":50," + tag + " :25", twice},
 		{tagLimitPercent, tag + ":50,,", emptyItem},
 	} {