Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/discriminator/discriminator.go

@@ -89,12 +89,12 @@ var (
 //
 //nolint:tagliatelle // docs/request-log.md names the fields in snake_case
 type Report struct {
-	RequestID             string  `json:"request_id"`
-	Status                int     `json:"status"`
-	RequestBytes          int64   `json:"request_bytes"`
-	ResponseBytes         int64   `json:"response_bytes"`
-	DurationTotal         float64 `json:"duration_total"`
-	DurationUpstreamTotal float64 `json:"duration_upstream_total"`
+	RequestID               string  `json:"request_id"`
+	Status                  int     `json:"status"`
+	RequestBytes            int64   `json:"request_bytes"`
+	ResponseBytes           int64   `json:"response_bytes"`
+	DurationTotalMS         float64 `json:"duration_total_ms"`
+	DurationUpstreamTotalMS float64 `json:"duration_upstream_total_ms"`
 }
 
 // New returns the server `sww discriminator` runs. It answers
@@ -183,7 +183,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 	rq.line.DiscriminatorLine = requestlog.DiscriminatorLineDecision
 	refused := rq.check(r.Context())
 	rq.checked = time.Now()
-	underOwnPrefix := strings.HasPrefix(r.URL.Path, adminPrefix)
+	underOwnPrefix := strings.HasPrefix(r.URL.Path, ownEndpointPrefix)
 
 	if refused == nil && !underOwnPrefix {
 		// In observe mode, what enforce mode would have refused counts here.
@@ -208,7 +208,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 
 	// The app never sees this prefix. discriminator's own endpoints are at its
 	// own address, so this answers as a path with no endpoint does.
-	rq.line.Action = requestlog.ActionAdmin
+	rq.line.Action = requestlog.ActionOwnEndpoint
 	rq.out.Header().Set(DispositionHeader, DispositionDeny)
 	http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
 }
@@ -405,7 +405,7 @@ func readReport(w http.ResponseWriter, r *http.Request) (Report, error) {
 
 	for _, name := range []string{
 		"request_id", "status", "request_bytes", "response_bytes",
-		"duration_total", "duration_upstream_total",
+		"duration_total_ms", "duration_upstream_total_ms",
 	} {
 		value, there := fields[name]
 		if !there || string(value) == "null" {
@@ -431,11 +431,11 @@ func (report *Report) checkRanges() error {
 		return fmt.Errorf("%w: request_bytes", errReportValue)
 	case report.ResponseBytes < 0 || report.ResponseBytes > maxReportedBytes:
 		return fmt.Errorf("%w: response_bytes", errReportValue)
-	case report.DurationTotal < 0 || report.DurationTotal > maxReportedMilliseconds:
-		return fmt.Errorf("%w: duration_total", errReportValue)
-	case report.DurationUpstreamTotal < 0 ||
-		report.DurationUpstreamTotal > maxReportedMilliseconds:
-		return fmt.Errorf("%w: duration_upstream_total", errReportValue)
+	case report.DurationTotalMS < 0 || report.DurationTotalMS > maxReportedMilliseconds:
+		return fmt.Errorf("%w: duration_total_ms", errReportValue)
+	case report.DurationUpstreamTotalMS < 0 ||
+		report.DurationUpstreamTotalMS > maxReportedMilliseconds:
+		return fmt.Errorf("%w: duration_upstream_total_ms", errReportValue)
 	}
 
 	return nil
@@ -459,18 +459,18 @@ func (h *handler) finishWith(ctx context.Context, held *decision, report Report)
 	rq.line.Status = report.Status
 	rq.line.RequestBytes = report.RequestBytes
 	rq.line.ResponseBytes = report.ResponseBytes
-	rq.line.DurationTotal = report.DurationTotal
+	rq.line.DurationTotalMS = report.DurationTotalMS
 
 	if rq.allowed {
-		rq.line.DurationUpstreamTotal = &report.DurationUpstreamTotal
+		rq.line.DurationUpstreamTotalMS = &report.DurationUpstreamTotalMS
 
 		rq.runBanningHeuristics(ctx, onReport())
 		rq.countAnomalies()
 		rq.addToHistory()
 
 		rq.h.metrics.RequestReported(&rq.line,
-			time.Duration(report.DurationTotal*float64(time.Millisecond)),
-			time.Duration(report.DurationUpstreamTotal*float64(time.Millisecond)))
+			time.Duration(report.DurationTotalMS*float64(time.Millisecond)),
+			time.Duration(report.DurationUpstreamTotalMS*float64(time.Millisecond)))
 	}
 
 	rq.writeLine()