Rename the program to sww and its deciding daemon to discriminator (closes #218)

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the OS user, and the state and rules directories.
The SWWAF_ environment variables take the SWW_ form.

No logic changes. make check passes.

Model: deepseek-v4-pro

docs/image.md

@@ -1,7 +1,7 @@
 # What the image holds
 
 The contents of the `smallwebwaf` image, and how each part is pinned. The image
-runs `rproxy` by default, or `servewaf` with `SMALLWEBWAF_COMMAND=servewaf`.
+runs `rproxy` by default, or `discriminator` with `SWW_COMMAND=discriminator`.
 "Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
 is pinned that way.
 
@@ -15,13 +15,12 @@ is pinned that way.
   Unpacked, nixpkgs takes about 500 MiB.
 - `runsvinit` as the entrypoint, built from `github.com/peterbourgon/runsvinit`
   at a fixed commit hash.
-- The `smallwebwaf` binary, and the user `smallwebwaf` (uid and gid 65532).
-- The service directory `/etc/service/smallwebwaf`, with the `run` script
-  `share/smallwebwaf.run`.
-- `/var/lib/smallwebwaf` for `servewaf`'s state files, and
-  `/etc/smallwebwaf/rules.d` with the default rule file
-  `share/rules.d/00-default.rules`.
-- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `smallwebwaf healthcheck`.
+- The `sww` binary, and the user `sww` (uid and gid 65532).
+- The service directory `/etc/service/sww`, with the `run` script
+  `share/sww.run`.
+- `/var/lib/sww` for `discriminator`'s state files, and `/etc/sww/rules.d` with
+  the default rule file `share/rules.d/00-default.rules`.
+- `EXPOSE 8080`, and the `HEALTHCHECK` that runs `sww healthcheck`.
 
 ## Pins
 
@@ -33,4 +32,4 @@ is pinned that way.
 - `runsvinit`: the archived repository, unchanged since 2015, at its last commit
   (`b4b2c78`, eight commits after `v2.0.0`), by commit hash, with a `go.mod` the
   build writes.
-- The Go image that builds `smallwebwaf`: by digest.
+- The Go image that builds `sww`: by digest.