Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/discriminator/answertime_test.go

@@ -36,8 +36,8 @@ const (
 	// tooLarge is how discriminator refuses a request over the header limits.
 	tooLarge = http.StatusRequestHeaderFieldsTooLarge
 	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
-	// that unansweredGeoJSURL names too.
-	silentAbuseIPDBURL = "unanswered://abuseipdb/api/v2/check"
+	// that silentGeoJSURL names too.
+	silentAbuseIPDBURL = "silent://abuseipdb/api/v2/check"
 	// wholeLimit is the percentage of a rate limit that lowers it not at all.
 	wholeLimit = 100
 	// clientsDecision is the CrowdSec decision list holding client alone.
@@ -86,8 +86,8 @@ func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
 
-	if line.DurationWAF != nil {
-		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationWAF)
+	if line.DurationCoreRuleSetMS != nil {
+		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationCoreRuleSetMS)
 	}
 }
 
@@ -165,7 +165,7 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 			wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
-			if line.DurationWAF == nil {
+			if line.DurationCoreRuleSetMS == nil {
 				t.Error("the Core Rule Set did not read a request within the limits")
 			}
 		})
@@ -220,9 +220,9 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 
 	line := s.out.requestLine(t)
 	if line.WouldAction != requestlog.ActionRequestHeaderTooLarge ||
-		line.DurationWAF != nil {
-		t.Errorf("would_action %q and duration_waf %v, want %q and none",
-			line.WouldAction, line.DurationWAF, requestlog.ActionRequestHeaderTooLarge)
+		line.DurationCoreRuleSetMS != nil {
+		t.Errorf("would_action %q and duration_core_rule_set_ms %v, want %q and none",
+			line.WouldAction, line.DurationCoreRuleSetMS, requestlog.ActionRequestHeaderTooLarge)
 	}
 }
 
@@ -283,8 +283,8 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	line := s.out.requestLine(t)
 	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
 
-	if line.LimitPercent != nil {
-		t.Errorf("limit percentage %d, want none", *line.LimitPercent)
+	if line.RateLimitPercent != nil {
+		t.Errorf("limit percentage %d, want none", *line.RateLimitPercent)
 	}
 
 	// The client is under no ban, and GeoJS places it in a country.
@@ -340,7 +340,7 @@ func newDiscriminatorInBubble(
 	settings := map[string]string{tagDeny: "country=KP"}
 	maps.Copy(settings, env)
 
-	server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now, settings)
+	server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now, settings)
 
 	return server, out
 }