Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/bans/crowdsec_test.go

@@ -15,7 +15,7 @@ const scenario = "crowdsecurity/ssh-bf"
 func TestCrowdSecBanLastsUntilTheDecisionEnds(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	expires := midnight().Add(4 * time.Hour)
 
@@ -49,7 +49,7 @@ func TestCrowdSecBanLastsUntilTheDecisionEnds(t *testing.T) {
 func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	expires := midnight().Add(4 * time.Hour)
 	ledger.BanForCrowdSec(netblock, midnight(), expires, scenario, bans.Notes{})
@@ -72,7 +72,7 @@ func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
 func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
 	// Three times the three days would be permanent; a limit broken as the