Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the OS user, and the state and rules directories.
The SWWAF_ environment variables take the SWW_ form.

No logic changes. make check passes.

Model: deepseek-v4-pro

deploy/example-app/Dockerfile

@@ -6,8 +6,8 @@
 # A real app names the smallwebwaf image by digest. This one takes the
 # image script/example-app has just built, or else the one `make docker`
 # builds.
-ARG SMALLWEBWAF_IMAGE=smallwebwaf
-FROM ${SMALLWEBWAF_IMAGE}
+ARG SWW_IMAGE=smallwebwaf
+FROM ${SWW_IMAGE}
 
 # Packages the app needs, from the nixpkgs in the image.
 RUN nix-env -iA nixpkgs.busybox