Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/rproxy/request.go

@@ -371,8 +371,8 @@ func (rq *request) finish(ctx context.Context) {
 		Status:             rq.out.status,
 		RequestBytes:       requestBytes,
 		ResponseBytes:      responseBytes,
-		DurationRequest:    requestlog.Milliseconds(requestEnd.Sub(rq.start)),
-		DurationResponse:   requestlog.Milliseconds(end.Sub(requestEnd)),
+		DurationRequestMS:  requestlog.Milliseconds(requestEnd.Sub(rq.start)),
+		DurationResponseMS: requestlog.Milliseconds(end.Sub(requestEnd)),
 		Disposition:        rq.disposition,
 		DefaultDisposition: rq.byDefault,
 	})
@@ -385,14 +385,14 @@ func (rq *request) finish(ctx context.Context) {
 	}
 
 	report := &discriminator.Report{
-		RequestID:     rq.id,
-		Status:        min(rq.out.status, reportStatusMax),
-		RequestBytes:  requestBytes,
-		ResponseBytes: responseBytes,
-		DurationTotal: requestlog.Milliseconds(end.Sub(rq.start)),
+		RequestID:       rq.id,
+		Status:          min(rq.out.status, reportStatusMax),
+		RequestBytes:    requestBytes,
+		ResponseBytes:   responseBytes,
+		DurationTotalMS: requestlog.Milliseconds(end.Sub(rq.start)),
 	}
 	if !rq.upstreamStart.IsZero() {
-		report.DurationUpstreamTotal = requestlog.Milliseconds(end.Sub(rq.upstreamStart))
+		report.DurationUpstreamTotalMS = requestlog.Milliseconds(end.Sub(rq.upstreamStart))
 	}
 
 	rq.h.sendReport(ctx, report)