SPEC: false statements fixed, repeats removed, dropped requirements restored

The bounds sentence, the blocklist URL sentence, the deny list sentence,
the limit action's scope and the observe mode sentence now say what the
code does. Each of the twenty-one requirements the fourth review found
twice is stated once, with a link from the other place. The request id
header, redirect_uri's case, change 4's reason and the live archive's
InRelease files are back. The biased thresholds are defined where they
are introduced. The docs files apply the fifth README review's findings
and stay identical to the README branch.

Model: fable-5-1

docs/metrics.md

@@ -1,10 +1,8 @@
 # The metrics
 
-`GET /_smallwebwaf/metrics` answers in the Prometheus text format. The
-requirements are under "Metrics endpoint" in [`SPEC.md`](../SPEC.md); this file
-lists the metrics. Every metric carries the label `instance`, set to
-`SWWAF_INSTANCE_NAME`; Prometheus keeps it as `exported_instance` unless the
-scrape sets `honor_labels: true`. No metric carries a client's address.
+The metrics `GET /_smallwebwaf/metrics` answers with, as "Metrics endpoint" in
+[`SPEC.md`](../SPEC.md) describes it. Prometheus keeps the `instance` label as
+`exported_instance` unless the scrape sets `honor_labels: true`.
 
 ## Traffic