Address ranges in address match lists (IPv4 and IPv6)

ACLs, views' match lists, options with address match lists and blocking
client groups take ranges such as 10.0.10.101-10.0.10.199 or
2001:db8::100-2001:db8::1ff (negated, or with spaces around the dash, too).
Jarl stores the range as written and writes the fewest prefixes that cover
exactly that range to named.conf, with the range as a comment. New package
internal/iprange; namedconf gets an AMRange element (a range used to parse
as an ACL name), ExpandRanges and statement comments. Mistakes are refused
when entered, validation sees what ranges cover, and IPv6 ranges in the
IPv4-mapped space get a warning. The web UI shows what a range becomes
while typing (GET /catalog/ranges).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,12 @@ All notable changes to Jarl are documented here. The format follows
 
 ## [Unreleased]
 
+### Upgrading from 0.4
+
+- Once you use address ranges, the database can't go back to 0.4: its
+  parser doesn't know them. Remove the ranges first if you need to
+  downgrade.
+
 ### Fixed
 
 - A changeset with a staged record delete could not be applied after that
@@ -19,6 +25,21 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Added
 
+- Address ranges such as `10.0.10.101-10.0.10.199` or
+  `2001:db8::100-2001:db8::1ff` (also `!` negated, and with spaces around
+  the dash) wherever an address match list is used: ACLs, views'
+  match-clients and match-destinations, options such as allow-query, and
+  blocking's client groups ([docs/concepts.md](docs/concepts.md)). Jarl
+  keeps the range as written and writes the fewest prefixes that cover
+  exactly that range to named.conf, with the range as a comment. The web
+  UI shows what a range becomes while you type it (`GET
+  /catalog/ranges`). Mistakes are refused when entered: an end that isn't
+  a full address, the start after the end, IPv4 mixed with IPv6, a range
+  in an option that takes no address match list (forwarders). A range
+  covered by an earlier element is reported as never matching, a range of
+  every address counts as "any" for the open resolver and open transfer
+  checks, and an IPv6 range in the IPv4-mapped space gets a warning. ACL
+  names can no longer look like a range.
 - Prometheus metrics at `/metrics` ([docs/metrics.md](docs/metrics.md)),
   set up in the new `metrics:` section of jarl.yaml (off by default).
   `metrics.allow` lists the addresses that may scrape (loopback by