Support IP ranges in the Shields IP block list?

[ndbroadbent]

The IP block list only takes exact addresses, so it can't cover traffic that moves around inside a range: an office on dynamic IPs, IPv6 clients, or a crawler on rotating proxies. There's a request for this at https://feedback.plausible.io/675, and the original IP block list PR (#3761) said netmask support could follow if there was demand.

We needed this on our self-hosted instance, so we've written a patch. Would you take it as a PR?

Branch: https://github.com/DocSpring/analytics/tree/shield-ip-ranges

How it works:

• A rule can have a netmask, down to /8 for IPv4 and /32 for IPv6. The column is already a Postgres inet, so there's no migration.
• Rules for a single address are cached and matched as they are today.
• A range can't be looked up by address, so each site's ranges are cached together in one list, which is checked after the exact lookup. An event for a site with no ranges does one extra cache lookup and nothing else.
• Only a full cache refresh builds that list, so a new range takes effect within a few minutes, as the UI already says.

One behaviour change: IPv6 rules with a /32 netmask could already be saved, but they never matched anything. They'd start blocking the range they describe.

Two things we'd like your view on: the widest ranges to allow (/8 and /32 here), and whether a range should count the same as a single address towards the limit of 30 rules per site, as it does in this patch.

If you'd take it, we'll open the PR, sign the CLA and send the matching change to the docs repo.