Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/bans/snapshot_test.go

@@ -14,7 +14,7 @@ import (
 func TestChangedAfterABanIsMade(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
 	wantChanged(t, ledger, false)
@@ -38,7 +38,7 @@ func TestChangedAfterABanIsMade(t *testing.T) {
 func TestSnapshotListsEveryBanByNetblock(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	v6 := netip.MustParsePrefix("2001:db8::/64")
 	high := netip.MustParsePrefix("203.0.113.10/32")
 	low := netip.MustParsePrefix("203.0.113.9/32")
@@ -67,14 +67,14 @@ func TestSnapshotListsEveryBanByNetblock(t *testing.T) {
 func TestLoadedBansCarryOn(t *testing.T) {
 	t.Parallel()
 
-	before := bans.New(defaultRules())
+	before := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	ban, _ := before.BanForLimit(netblock, midnight(), bans.Notes{Limit: 1})
 
 	// Loaded into a new ledger, as across a restart, the ban still refuses
 	// while it lasts, and once it has ended a broken limit bans for three
 	// times as long, with the loaded ban counted among the earlier ones.
-	after := bans.New(defaultRules())
+	after := bans.New(defaultParams())
 	after.Load(before.Snapshot())
 
 	_, banned, _ := after.Check(netblock.Addr(), ban.Expires.Add(-time.Second))
@@ -96,7 +96,7 @@ func TestLoadedBanRefusesEveryClientInItsNetblock(t *testing.T) {
 	// Two entries as an admin might write them, with addresses not masked
 	// to their lengths, the IPv6 one shorter than the /64 an IPv6 client's
 	// ban covers, beside a ban the ledger makes on one IPv4 address.
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{
 		{Netblock: netip.MustParsePrefix("203.0.113.9/24"), Start: midnight()},
 		{Netblock: netip.MustParsePrefix("2001:db8::1/48"), Start: midnight()},
@@ -145,7 +145,7 @@ func TestPermanentBanStartedBeforeAnEndedOneRefuses(t *testing.T) {
 		Expires:  midnight().Add(time.Hour),
 	}
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{permanent, ended})
 
 	now := midnight().Add(2 * time.Hour)
@@ -189,7 +189,7 @@ func TestNextBanWorkedOutFromTheBanThatEndedLast(t *testing.T) {
 		Expires:  midnight().Add(2 * time.Hour),
 	}
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{nineHours, admins})
 
 	// Once both have ended, a limit broken within the repeat window bans
@@ -219,9 +219,9 @@ func TestLoadKeepsAtMostMaxBansDroppingTheEarliest(t *testing.T) {
 		Cause:    bans.CauseLimit,
 	}
 
-	rules := defaultRules()
-	rules.MaxBans = 1
-	ledger := bans.New(rules)
+	params := defaultParams()
+	params.MaxBans = 1
+	ledger := bans.New(params)
 	ledger.Load([]bans.Ban{later, earlier})
 
 	held := ledger.Snapshot()
@@ -235,9 +235,9 @@ func TestLoadReplacesTheBansHeld(t *testing.T) {
 
 	// Room for three bans, so that the second load, were it added to the
 	// two bans held, would drop none of them to make room.
-	rules := defaultRules()
-	rules.MaxBans = 3
-	ledger := bans.New(rules)
+	params := defaultParams()
+	params.MaxBans = 3
+	ledger := bans.New(params)
 	kept := bans.Ban{
 		Netblock: netip.MustParsePrefix("2001:db8::/64"),
 		Start:    midnight(),
@@ -285,7 +285,7 @@ func TestLoadCutsTheTextsTo256Bytes(t *testing.T) {
 		}},
 	}
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{ban})
 
 	cut := long[:256]