Guard: watch logs, ban misbehaving addresses in Housecarl

Files and the journal, patterns with one <IP>, bounties within a window,
bans in a Housecarl ban list with repeat offenders' bans growing; presets
for sshd, jarl, housecarl, steward, bind-xfr, postfix-sasl, dovecot,
nginx-auth and housecarl-drops; guard run/check/test/status/bans/ban/unban;
a Debian package with a sandboxed unit; an end-to-end test with Housecarl.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

deploy/debian/control.in

@@ -0,0 +1,18 @@
+Package: guard
+Version: @VERSION@
+Architecture: @ARCH@
+Maintainer: @MAINTAINER@
+Installed-Size: @SIZE@
+Depends: systemd
+Section: net
+Priority: optional
+Description: bans addresses that misbehave in the logs, at the firewall
+ Guard watches log files and the systemd journal for failed logins,
+ scans and other misdeeds, counts each address's matches, and bans an
+ address that reaches a watch's limit in a ban list of Housecarl, the
+ firewall manager: the firewall then keeps it from this machine (or from
+ what the list says). One YAML file configures it; presets cover OpenSSH,
+ Postfix, Dovecot, nginx, BIND, Jarl, Housecarl and Steward.
+ .
+ guard isn't started on a first install: see
+ /usr/share/doc/guard/docs/install.md.