Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/discriminator/bans.go

@@ -106,7 +106,7 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 	case ratelimit.KindBytes:
 		rq.line.LimitHit = hit.Window + "_bytes" // as counts names the byte totals
 	case ratelimit.KindRefusals:
-		rq.line.LimitHit = requestlog.LimitHitErrorBurst
+		rq.line.LimitHit = requestlog.LimitHitMinuteRefusals
 	default:
 		rq.line.LimitHit = hit.Window
 	}
@@ -134,9 +134,9 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 
 	switch hit.Kind {
 	case ratelimit.KindRequests:
-		notes.LimitPercent, notes.LimitPercentSetting = rq.limitPercent.logged()
+		notes.LimitPercent, notes.LimitPercentSetting = rq.rateLimitPercent.logged()
 	case ratelimit.KindBytes:
-		notes.LimitPercent, notes.LimitPercentSetting = rq.bytesPercent.logged()
+		notes.LimitPercent, notes.LimitPercentSetting = rq.bytesLimitPercent.logged()
 	}
 
 	if rq.h.config.Observe {