Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/config/config.go

@@ -336,7 +336,7 @@ const (
 	maxParanoiaLevel = 4
 	// firstSetupRuleID to lastSetupRuleID are the ids the Core Rule Set
 	// keeps for the rules that set it up, which sww's own rules
-	// have too (see internal/waf). Switching one off would undo a change
+	// have too (see internal/coreruleset). Switching one off would undo a change
 	// that no setting undoes.
 	firstSetupRuleID = 900000
 	lastSetupRuleID  = 900999
@@ -432,7 +432,7 @@ var (
 		"holds a control character, such as the carriage return of a Windows line end",
 	)
 	errNotAlertEvent = errors.New(
-		"is not ban, permanent_ban, waf_block, anomaly, reputation_hit, " +
+		"is not ban, permanent_ban, core_rule_set_match, anomaly, reputation_hit, " +
 			"source_failure or file_error")
 	errNotNumberOrOff = errors.New(
 		"is not a whole number above zero, such as 60, or off",