Basic Firewall 1.0.0-rc.6

Sixth release candidate for 1.0.0. Published as a GitHub pre-release, so
the releases/latest/download URL does not serve it; install it by its own URL.
The vulnerability score rule type is back, rebuilt on the library's own
scoring model (#52); latitude/longitude equality matches against a database
(#49); condition values are stored as typed, so < and %xx survive a save
(#60); and the unused geolocation license key is removed (#54). Read What
changes on upgrade for the two settings rewrites. What changed since
1.0.0-rc.5 is below.

What changes on upgrade

• Vulnerability score rules saved by a pre-release build are translated
  (schema 12). A rule with a threshold and no weights becomes one risk level
  that matches at that threshold, with the new type's default scores, and
  keeps its response and whether it was on — so a rule that matched nothing
  starts matching. A rule with weights has no equivalent in the library's
  scoring, so it is kept as it was, switched off, and named on the Status
  screen, in Site Health and in the rule list until you set its scores or
  delete it.
• Latitude/longitude is equal to, is not equal to and is one of
  start working against a MaxMind database (#49). Is not equal to stops
  matching every visitor.
• The geolocation and ASN license key is deleted (schema 13, #54). Every
  stored copy is removed from the rules that held one; nothing read it, so no
  rule changes what it matches.

Added

• The vulnerability score rule type is back, rebuilt on the library's
  scoring model (#52). Withdrawn from 1.0 because it saved a threshold and
  weights the library's VulnerabilityScore plugin never reads. It now
  stores exactly what that plugin reads: risk levels (a threshold, whether
  the rule matches there, and an optional status code and ban length per
  level) and scores for the request method, attack patterns, user agent,
  country and network, with a MaxMind Country and ASN database opened only
  when a score needs one. Defaults are a working subset of the library's
  malicious-requests preset. The form refuses what the library would
  reject or silently ignore: a regex without matching delimiters or that
  does not compile, an unknown location or match type, a matching level at
  zero or below, duplicate level names or thresholds, a pass level above a
  matching one, and country or network scores without a database. Every
  field is covered by the honoured-settings tests against the real library.
  See "What changes on upgrade" for rules saved by a pre-release build.

Fixed

• Latitude/longitude is equal to, is not equal to and is one of
  match against a MaxMind database (fixes #49). The record holds floats,
  the value compiled as text, and the library compares these operators
  strictly (2.35 coerces only the ASN), so is equal to never matched and
  is not equal to matched every visitor. A database-backed geolocation
  rule now compiles those values as numbers; a CDN-backed one sends text
  and is compiled as before. Rules need no change.

• Patterns keep < and percent-encoded characters through the rule
  screen. The textarea sanitiser stripped both from the vulnerability
  score's patterns on every save; fields a type marks verbatim are now
  read as typed, and still checked by the type's validator.

• Condition values are stored as typed (fixes #60). The rule screen put
  every condition value through the textarea sanitiser, which turns < into
  < or strips it with whatever follows, and deletes every %xx
  sequence, so a URL rule on query.q contains %3Cscript was stored as a
  rule on script and one on path contains %2e was refused for having no
  value. Condition values on every condition rule type (URL, user agent,
  geolocation, ASN, edge signal), the fields of a referenced list, and
  rate-limit lines are now read as typed, with only control characters
  removed and whitespace at either end trimmed (as before, so a pasted
  trailing space can't leave a block rule matching nothing; a regex can still
  match a leading or trailing space with \s); the rule type's validator
  checks them (operator, regex, UTF-8, at most 4,096 characters). The pasted document on the Import and Rules
  screens, the Advanced YAML box and the Test screen's path, user agent,
  headers and body are read the same way. A value that contains an entity,
  such as <, now survives being saved again untouched.

Removed

• The MaxMind license key field on geolocation and ASN rules (fixes #54).
  It was kept "for whatever downloads the database", and nothing did: the
  firewall only ever opens a local database. The stored value is deleted on
  upgrade (see above), and an imported document that still carries it is
  imported without it, with a note in the preview.