Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/ratelimit/ratelimit.go

@@ -123,11 +123,12 @@ type Offences struct {
 	// Limit is its requests that broke a rate limit, a byte limit or the
 	// error burst, Attack those that were a clear sign of attack, a match
 	// of a ban rule or a request for a trap path, BlockedByBlockRule those a
-	// block rule refused, and WAFBlocked those the Core Rule Set refused.
-	Limit              int64 `json:"limit"`
-	Attack             int64 `json:"attack"`
-	BlockedByBlockRule int64 `json:"blocked_by_block_rule"`
-	WAFBlocked         int64 `json:"waf_blocked"`
+	// block rule refused, and BlockedByCoreRuleSet those the Core Rule Set
+	// refused.
+	Limit                int64 `json:"limit"`
+	Attack               int64 `json:"attack"`
+	BlockedByBlockRule   int64 `json:"blocked_by_block_rule"`
+	BlockedByCoreRuleSet int64 `json:"blocked_by_core_rule_set"`
 	// TokenRefused is what a clients.json written by an earlier version gives,
 	// which must still load. Nothing adds to it.
 	TokenRefused int64 `json:"token_refused,omitempty"`
@@ -148,11 +149,11 @@ type Request struct {
 	// BrokeLimit is true for a request that broke a rate limit, a byte
 	// limit or the error burst, Attack for one that matched a ban rule or
 	// asked for a trap path, BlockedByBlockRule for one a block rule refused,
-	// and WAFBlocked for one the Core Rule Set refused.
-	BrokeLimit         bool
-	Attack             bool
-	BlockedByBlockRule bool
-	WAFBlocked         bool
+	// and BlockedByCoreRuleSet for one the Core Rule Set refused.
+	BrokeLimit           bool
+	Attack               bool
+	BlockedByBlockRule   bool
+	BlockedByCoreRuleSet bool
 }
 
 // New returns a Limiter for limits, with no client counted yet, whose
@@ -327,8 +328,8 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 		h.Offences.BlockedByBlockRule++
 	}
 
-	if r.WAFBlocked {
-		h.Offences.WAFBlocked++
+	if r.BlockedByCoreRuleSet {
+		h.Offences.BlockedByCoreRuleSet++
 	}
 }