Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

SPEC.md

@@ -81,8 +81,8 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/waf`: the Core Rule Set, with the eight changes listed under
-      "Attack detection", as Coraza directives.
+    - `internal/coreruleset`: the Core Rule Set, with the eight changes listed
+      under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
     - `internal/reputation`: fetches the lists, asks the DNS blocklists and
@@ -655,7 +655,7 @@ files, the limits and the bans still apply to the client that sends it.
   match, and scores are still logged. A request with more than 1000 query
   parameters or body fields adds 5 to its score, since Coraza reads only the
   first 1000. For a match, in `block` and `detect` mode alike, the log line
-  gives the rule ids and the score, and a `waf_block` alert is sent.
+  gives the rule ids and the score, and a `core_rule_set_match` alert is sent.
 - `SWW_WAF_DISABLED_RULES` switches off rule ids when an app trips a false
   positive. The default switches off six rules:
     - 920340, 920420 and 920640 refuse a request for the type of its body, when
@@ -789,8 +789,8 @@ every app, and no setting undoes them:
    such as `owner/python3-app` would have that push refused.
 8. On gitea's paths, some fields skip the rules that refused ordinary gitea
    requests there. They are the fields where gitea sends a search, a file name
-   or a branch name. `internal/waf/gitea.conf` lists each rule and the request
-   it refused. The fields are:
+   or a branch name. `internal/coreruleset/gitea.conf` lists each rule and the
+   request it refused. The fields are:
     - `q` on gitea's searches of code, of issues and pull requests, and of
       commits. A code search holds code, such as `<script>`,
       `SELECT * FROM users WHERE` or `../`.
@@ -1378,11 +1378,11 @@ these fields, named as the request log's fields of the same meaning:
 - `request_bytes` and `response_bytes`: the body bytes each way, with what a
   WebSocket carried each way, each a whole number from `0` to `1125899906842624`
   (1 PiB);
-- `duration_total`: milliseconds from the request's headers being read to the
+- `duration_total_ms`: milliseconds from the request's headers being read to the
   end of the answer, from `0` to `1000000000000` (about 31 years);
-- `duration_upstream_total`: milliseconds from the hand-over to the app to the
-  end of the answer, in the same range, and `0` for a request not passed to the
-  app.
+- `duration_upstream_total_ms`: milliseconds from the hand-over to the app to
+  the end of the answer, in the same range, and `0` for a request not passed to
+  the app.
 
 `discriminator` answers `400` and writes a process warning when the body: