Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/rproxy/rproxy.go

@@ -45,9 +45,9 @@ const (
 	idleTimeout = 120 * time.Second
 )
 
-// adminPrefix starts the path of every request for sww itself, which
+// ownEndpointPrefix starts the path of every request for sww itself, which
 // never reaches the app.
-const adminPrefix = "/_sww/"
+const ownEndpointPrefix = "/_sww/"
 
 // allowedMethods lists the methods rproxy passes on, as an Allow header gives
 // them. It answers any other method 405 itself.
@@ -211,8 +211,8 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 // passToApp passes the request on to the app, unless a limit or its path keeps
-// it from the app. discriminator answers a path under adminPrefix itself, so such a
-// request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
+// it from the app. discriminator answers a path under ownEndpointPrefix itself, so
+// such a request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
 // request's own context.
 func (rq *request) passToApp(ctx context.Context) {
 	maxBytes := rq.h.config.MaxRequestSize
@@ -220,7 +220,7 @@ func (rq *request) passToApp(ctx context.Context) {
 	switch {
 	case rq.refused.Load() != 0 || (maxBytes > 0 && rq.in.ContentLength > maxBytes):
 		rq.answer(http.StatusRequestEntityTooLarge)
-	case strings.HasPrefix(rq.in.URL.Path, adminPrefix):
+	case strings.HasPrefix(rq.in.URL.Path, ownEndpointPrefix):
 		rq.answer(http.StatusNotFound)
 	default:
 		rq.forward(ctx)