Patch & Protect statistics

The attacks Patch & Protect blocked on one website: how many per day, the addresses that insisted the most with their country, and the rules that fired, each with its own total. `start_date` and `end_date` are whole days (`YYYY-MM-DD`), never in the future, and both optional: the default is the last seven whole days. That default is the period kept ready. Modular DS stores one period per website and refreshes it every few hours, so a read of the default range is answered from what is stored and `cached_at` says when it was read. Asking for any other period reads it from the security provider, stores it in place of the previous one and answers it, which takes longer. The figures need the add-on subscribed and the statistics permission; without them the call answers 404. Unlike the rest of this surface, the payload is not a JSON:API document: it is the statistics block on its own.