Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files.

Model: opus-5-5

internal/sww/sww_test.go

@@ -20,9 +20,9 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/config"
-	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup/lookuptest"
 	"sneak.berlin/go/smallwebwaf/internal/sww"
+	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 const (
@@ -123,11 +123,11 @@ func (o *output) text() string {
 	return o.buf.String()
 }
 
-// run runs `sww discriminator` with the settings in env until ctx is done,
+// run runs `sww waf` with the settings in env until ctx is done,
 // and returns its exit status. SWW_LOOKUP_SOURCE is off unless env sets it,
 // so that no test sends GeoJS its clients' addresses.
 func run(ctx context.Context, env map[string]string, out *output) int {
-	return sww.RunDiscriminator(ctx, sww.Params{
+	return sww.RunWAF(ctx, sww.Params{
 		Version: testVersion,
 		LookupEnv: func(name string) (string, bool) {
 			value, ok := env[name]
@@ -1245,7 +1245,7 @@ func startApp(t *testing.T) string {
 	return app.URL
 }
 
-// runUntilStopped runs `sww discriminator` with the settings in env, has use
+// runUntilStopped runs `sww waf` with the settings in env, has use
 // send it requests at url, then stops it as SIGTERM does, checks that it
 // stopped in order, and returns its output.
 func runUntilStopped(
@@ -1319,7 +1319,7 @@ func wantStartingLine(t *testing.T, line map[string]any, dir string) {
 	}
 }
 
-// wantAllowed checks that discriminator at url allows a request from localhost.
+// wantAllowed checks that waf at url allows a request from localhost.
 func wantAllowed(t *testing.T, url string) {
 	t.Helper()
 
@@ -1504,7 +1504,7 @@ func onlyBan(t *testing.T, dir string) map[string]any {
 	return file.Bans[0]
 }
 
-// wantRefused checks that discriminator at url refuses a request from localhost with
+// wantRefused checks that waf at url refuses a request from localhost with
 // 403, the default SWW_BAN_RESPONSE.
 func wantRefused(t *testing.T, url string) {
 	t.Helper()
@@ -1681,8 +1681,8 @@ func (w *webhook) waitFor(t *testing.T, event string, answered bool) webhookPost
 }
 
 // statusFrom returns the status a request to url from the client at from is
-// answered with. The request serves rproxy and discriminator alike. rproxy reads the
-// client from X-Forwarded-For, and replaces the other two headers. To discriminator,
+// answered with. The request serves rproxy and waf alike. rproxy reads the
+// client from X-Forwarded-For, and replaces the other two headers. To waf,
 // they make it a question about that client.
 func statusFrom(t *testing.T, url, from string) int {
 	t.Helper()
@@ -1694,7 +1694,7 @@ func statusFrom(t *testing.T, url, from string) int {
 	}
 
 	req.Header.Set("X-Forwarded-For", from)
-	req.Header.Set(discriminator.ClientHeader, from)
+	req.Header.Set(waf.ClientHeader, from)
 	req.Header.Set("X-Request-ID", rand.Text())
 
 	transport := &http.Transport{}