update blacklist atomically with `ipset swap`

Create a temporary blacklist with the updated IP list and atomically swap with the actual blacklist so the blacklist is never empty.