Allow $private HTTP rule to block any private IP

This is a little magic compared with our previous approach of "list
every private IP range", but given then the sheer number we were
missing[1][2] this feels more reasonable.

Also refactor out some of the logic into separate classes, hopefully to
make things a little cleaner.

patchwork.md

@@ -408,3 +408,10 @@ Remove <!-- -->s in usages
 Added documentation for global functions (#592)
 ```
 Didn't port the docs over.
+
+```
+d83a68f3ff6e3833278a38798d06215293656e85
+
+Allow $private HTTP rule to block any private IP
+```
+The config still uses a `blacklist` and `whitelist` array.