Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/discriminator/admin.go

@@ -42,7 +42,7 @@ var (
 
 // answerHealth answers a request for the health endpoint.
 func (rq *request) answerHealth() {
-	rq.line.Action = requestlog.ActionAdmin
+	rq.line.Action = requestlog.ActionOwnEndpoint
 	// Set here rather than left to Go's server, which would set it only
 	// after the log line has taken the response's headers.
 	rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
@@ -55,7 +55,7 @@ func (rq *request) answerHealth() {
 // refused with 401. An endpoint whose token is unset answers 404, as any other
 // path does.
 func (rq *request) answerAdmin() {
-	rq.line.Action = requestlog.ActionAdmin
+	rq.line.Action = requestlog.ActionOwnEndpoint
 
 	token, answer := rq.endpoint()