Keep a scan out of route-proxy's unrouted state: only names under a served domain, a few a minute, no visitor address (issue 774)

Review of ddae6729: a scanner's random Host or SNI names each became a key, bounded only by the
bucket's lifetime and size, and every failed write was retried at each change and logged each time.

A refused name is now kept by name only under the registrable domain of a name the proxy serves, and
at most five new names a minute; every other refusal is counted in memory and written once a minute
under <node>._other (last minute, since start), which route_proxy_unrouted shows. A refused write of
that state is dropped and logged once until a write succeeds; trimming memory to 4096 names moved
from the request to the writer. The visitor's address is no longer kept: the journal has it.

Quick: drop unrouted keys from strangers by a fixed allow-list. Thorough: bound by the proxy's own
domains, by rate, and by never retrying. Chose thorough: the scan is constant on a public machine.

modules/route-proxy/internal/routestate/routestate.go

@@ -8,6 +8,7 @@
 package routestate
 
 import (
+	"net"
 	"regexp"
 	"strings"
 	"time"
@@ -95,9 +96,9 @@ type Route struct {
 type Unrouted struct {
 	Name  string `json:"name"`
 	Proxy string `json:"proxy"`
-	// AskedAt is when the name was last asked for; From is who asked last.
+	// AskedAt is when the name was last asked for. Who asked is not kept here: the journal keeps it, for the
+	// machine's intrusion prevention.
 	AskedAt time.Time `json:"asked_at"`
-	From    string    `json:"from,omitempty"`
 	// Times is how often it was asked since the proxy last started.
 	Times int `json:"times"`
 	// InternalOnly says the name is served, but only inside the private network, and was asked from outside.
@@ -106,6 +107,34 @@ type Unrouted struct {
 	Handshake bool `json:"handshake,omitempty"`
 }
 
+// OtherName is the name of the one key per proxy that counts the refusals not kept by name: names under no domain
+// the proxy serves (what a scan sends), and names past the limit of new names a minute. Its key is
+// `<node>._other`; no host name begins with an underscore.
+const OtherName = "_other"
+
+// Other is the value of a proxy's OtherName key.
+type Other struct {
+	Proxy string `json:"proxy"`
+	// Minute is the last whole minute counted, and LastMinute how many refusals it held.
+	Minute     time.Time `json:"minute"`
+	LastMinute int       `json:"last_minute"`
+	// SinceStart is every refusal not kept by name since the proxy started.
+	SinceStart int `json:"since_start"`
+}
+
+// Registrable is the domain a name is registered under, as its last two labels; "" for an address or a single
+// label. Two labels is wrong for a public suffix of two (co.uk); it only decides which refused names are kept by name.
+func Registrable(name string) string {
+	if net.ParseIP(strings.Trim(name, "[]")) != nil {
+		return ""
+	}
+	labels := strings.Split(name, ".")
+	if len(labels) < 2 {
+		return ""
+	}
+	return strings.Join(labels[len(labels)-2:], ".")
+}
+
 var keyable = regexp.MustCompile(`^[a-z0-9_]([a-z0-9_.-]{0,251}[a-z0-9_])?$`)
 
 // Keyable says whether a name can be a key's name: what a host name or an address is. A name asked for in a request