discriminator: the header limits are the first check (closes #311)

A request over 50 cookies or 100 header fields is now refused by the first
check after SWW_ALLOW_NETS. It causes no lookup, no query to RouteWatch, a DNS
blocklist or AbuseIPDB, no rule file match and no Core Rule Set. The rate
limits no longer count it, and a banned or denied client gets 431 for it. It
makes no ban, makes no ban permanent and is not counted in a ban's notes. In
observe mode no lookup is made for it. Requests within the limits go through
the same checks in the same order.

Model: opus-5-5

README.md

@@ -511,7 +511,8 @@ of the request reaches the app.
 
 `discriminator` takes the checks:
 
-3. The header limits, then the tag lists.
+3. The header limits, then the tag lists. A client in `SWW_ALLOW_NETS` skips the
+   header limits.
 4. The static lists, `SWW_ALLOW_NETS` and `SWW_DENY_NETS`.
 5. The bans.
 6. The lookup of the client's AS number and country.

SPEC.md

@@ -147,12 +147,12 @@ request log's `heuristic` field gives that name. `refusal_limit` and
     - An IPv6 client is its group: the netblock of `SWW_IPV6_GROUP_PREFIX`
       around its address, a /64 by default, since one abuser usually controls a
       whole /64. A client is therefore one IPv4 address or one IPv6 group.
-3. The header limits (`header_limits`; see "Answering in time"). They come
-   before every other check, since they only count. Next, the tag lists
-   (`tag_lists`; see "Request tags"). Each list that holds the client adds its
-   tag. Next, `routewatch_tags` adds the client's `asn=` and `prefix=` tags
-   while `SWW_ROUTEWATCH_URL` is set. A client in `SWW_ALLOW_NETS` skips the
-   header limits and gets no tag.
+3. The header limits (`header_limits`; see "Answering in time"). They come first
+   after `SWW_ALLOW_NETS`, since they only count header fields and cookies.
+   Next, the tag lists (`tag_lists`; see "Request tags"). Each list that holds
+   the client adds its tag. Next, `routewatch_tags` adds the client's `asn=` and
+   `prefix=` tags while `SWW_ROUTEWATCH_URL` is set. A client in
+   `SWW_ALLOW_NETS` skips the header limits and gets no tag.
 4. The static lists. A client in `SWW_ALLOW_NETS` skips steps 5 to 15, the byte
    limits and the error burst. A client in `SWW_DENY_NETS` is refused
    (`deny_nets`); a client in both lists is let through.
@@ -240,11 +240,16 @@ still apply.
 ## Bans
 
 Until a ban ends, every request from its netblock is refused with
-`SWW_BAN_RESPONSE`. The netblock is the client: its IPv4 address, widened to
-`SWW_BAN_SCOPE_V4_PREFIX`, or its IPv6 group. At the defaults a ban covers one
-address or one /64, so a permanent ban does not reach neighbours who did
-nothing. Requests refused under a ban are not counted against limits. They are
-counted in the client's history and in the ban's notes.
+`SWW_BAN_RESPONSE`, unless it is over the header limits. The netblock is the
+client: its IPv4 address, widened to `SWW_BAN_SCOPE_V4_PREFIX`, or its IPv6
+group. At the defaults a ban covers one address or one /64, so a permanent ban
+does not reach neighbours who did nothing. Requests refused under a ban are not
+counted against limits. They are counted in the client's history and in the
+ban's notes.
+
+A request over the header limits is refused with `431` before the bans are
+checked (see "Answering in time"). It makes no ban, makes no ban permanent and
+is not counted in a ban's notes.
 
 An offence is a request `discriminator` holds against the client. It is one of:
 
@@ -2063,10 +2068,10 @@ Real clients never reach these limits. The answer is `deny` with `431`, and the
 log line's action is `request_header_too_large`. The refusal makes no ban and is
 no offence.
 
-The header limits are the first check. A request over them is refused before any
-other check runs. So it causes no lookup, no query to an outside source and no
-rule match, and the rate limits do not count it. A client under a ban or in
-`SWW_DENY_NETS` also gets `431` for such a request.
+The header limits are the first check after `SWW_ALLOW_NETS`. A request over
+them is refused before any later check runs. So it causes no lookup, no query to
+an outside source and no rule match, and the rate limits do not count it. A
+client under a ban or in `SWW_DENY_NETS` also gets `431` for such a request.
 
 The limits apply on every path and in every `SWW_WAF_MODE`. A client in
 `SWW_ALLOW_NETS` skips them, as it skips the Core Rule Set. In `observe` mode