Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

docs/metrics.md

@@ -28,7 +28,8 @@ body bytes, never headers, whatever `SWW_BYTES_COUNT` says.
 ## Attack detection
 
 - `sww_rule_matches_total`, by `rule_id` and `action`, and `sww_rules_loaded`;
-- `sww_waf_matches_total`, by `mode` and `rule_id`, for the rules that fired.
+- `sww_core_rule_set_matches_total`, by `mode` and `rule_id`, for the rules that
+  fired.
 
 ## Countries and AS numbers
 
@@ -43,8 +44,8 @@ For the `SWW_METRICS_TOP_N` busiest of each, the rest as `other`:
 ## Lookups
 
 - `sww_geojs_requests_total` and `sww_geojs_failures_total`;
-- `sww_geojs_unanswered_total`: the requests that needed an answer and went on
-  without it;
+- `sww_requests_without_geojs_answer_total`: the requests that needed an answer
+  and went on without it;
 - with the file source, `sww_lookup_database_last_read_timestamp_seconds` and
   `sww_lookup_database_read_failures_total`.
 
@@ -70,8 +71,8 @@ By `file`:
 ## Remote log, alerts and the process
 
 - while a syslog server is set, `sww_remote_log_lines_sent_total`,
-  `sww_remote_log_lines_dropped_total` and `sww_remote_log_buffer_depth`;
-- by `destination`, `sww_alerts_sent_total`, `sww_alerts_failed_total`,
+  `sww_remote_log_lines_dropped_total` and `sww_remote_log_lines_waiting`;
+- by `destination`, `sww_alerts_sent_total`, `sww_alert_send_failures_total`,
   `sww_alerts_suppressed_total` and `sww_alerts_dropped_total`;
 - Go's own `go_` metrics and the process's `process_` metrics.