Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the OS user, and the state and rules directories.
The SWWAF_ environment variables take the SWW_ form.

No logic changes. make check passes.

Model: deepseek-v4-pro

internal/waf/waf_test.go

@@ -15,7 +15,7 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// defaultDisabledRules are the rules SWWAF_WAF_DISABLED_RULES switches off
+// defaultDisabledRules are the rules SWW_WAF_DISABLED_RULES switches off
 // by default.
 //
 //nolint:gochecknoglobals // a constant cannot be a list
@@ -112,7 +112,7 @@ func matched(ids ...int) waf.Result {
 	return waf.Result{RuleIDs: ids, Score: critical * len(ids)}
 }
 
-// atDefaults returns the Core Rule Set as smallwebwaf runs it by default.
+// atDefaults returns the Core Rule Set as sww runs it by default.
 func atDefaults(t *testing.T) *waf.CoreRuleSet {
 	t.Helper()
 
@@ -455,7 +455,7 @@ func TestExclusionsFileThatCannotBeUsedIsAnError(t *testing.T) {
 
 	for _, tc := range []struct{ text, want string }{
 		{"SecNoSuchDirective On\n", "unknown directive"},
-		// smallwebwaf's own rules may not be switched off or changed, by
+		// sww's own rules may not be switched off or changed, by
 		// id or in a range, on one line or split over several.
 		{"SecRuleRemoveById 899999-901000\n", "names 899999-901000"},
 		{
@@ -525,7 +525,7 @@ func giteaRequests(t *testing.T) []request {
 func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 	t.Parallel()
 
-	const threshold = 5 // SWWAF_WAF_ANOMALY_THRESHOLD's default
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
 
 	crs := atDefaults(t)
 
@@ -550,7 +550,7 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 	}
 }
 
-// bodyLimit is SWWAF_WAF_BODY_LIMIT in the tests that read bodies.
+// bodyLimit is SWW_WAF_BODY_LIMIT in the tests that read bodies.
 const bodyLimit = 8 << 10
 
 // The Content-Type headers of the kinds of body the Core Rule Set reads.
@@ -564,7 +564,7 @@ const (
 // injection is an SQL injection, which rule 942100 matches.
 const injection = "1' OR '1'='1"
 
-// readingBodies returns the Core Rule Set as smallwebwaf runs it by
+// readingBodies returns the Core Rule Set as sww runs it by
 // default, but reading bodies up to bodyLimit.
 func readingBodies(t *testing.T) *waf.CoreRuleSet {
 	t.Helper()