Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files.

Model: opus-5-5

internal/waf/rulefiles.go

@@ -0,0 +1,62 @@
+package waf
+
+// The heuristic rule_files. It reads the rules of the rule files, which
+// SWW_RULES_DIR and SWW_RULES_ENABLED name.
+
+import (
+	"context"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/bans"
+	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+	"sneak.berlin/go/smallwebwaf/internal/rules"
+)
+
+// ruleFiles checks the request against the rules of the rule files at now,
+// notes the ids of those it matches in the log line, adds the tag
+// exploitsignature when it matches any, and refuses the request
+// when the last rule it matches refuses it: with ActionBlockedByBlockRule for a
+// block rule, and for a ban rule with the action for the ban it makes. A ban
+// rule bans the client's netblock for a clear sign of attack, or in observe
+// mode raises the alert for the ban
+// it would have made. Either rule's match is noted as an offence, for the
+// client's history. Its figures are the rule's id and action.
+type ruleFiles struct{}
+
+func (ruleFiles) name() string { return "rule_files" }
+
+func (ruleFiles) check(_ context.Context, rq *request, now time.Time) *verdict {
+	matched := rq.h.rules.Match(rq.in)
+
+	for _, rule := range matched {
+		rq.line.RuleIDs = append(rq.line.RuleIDs, rule.ID)
+		rq.h.metrics.RuleMatched(rule.ID, rule.Action)
+	}
+
+	if len(matched) == 0 {
+		return nil
+	}
+
+	rq.addTag(config.ExploitSignatureTag)
+
+	// Only the last rule matched can refuse the request.
+	last := matched[len(matched)-1]
+	figures := map[string]any{"rule_id": last.ID, "rule_action": last.Action}
+
+	switch last.Action {
+	case rules.ActionBlock:
+		rq.blockedByBlockRule = true
+
+		return &verdict{action: requestlog.ActionBlockedByBlockRule, figures: figures}
+	case rules.ActionBan:
+		rq.attack = true
+
+		return &verdict{
+			action:  rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target}),
+			figures: figures,
+		}
+	default:
+		return nil
+	}
+}