Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/state/state.go

@@ -64,7 +64,7 @@ var (
 	errCause       = errors.New("is not limit, attack, admin or crowdsec")
 	errExpires     = errors.New("is not after its start")
 	errDestination = errors.New("is not webhook, slack or ntfy")
-	errScope       = errors.New("is not client, net, asn, total or watch")
+	errScope       = errors.New("is not client, net, asn, total or watched_net")
 	errWaitingList = errors.New(`waiting is a list, but now lists the alerts by ` +
 		`destination: put the list under "webhook", as "waiting": {"webhook": [...]}, ` +
 		`or remove the file`)
@@ -858,8 +858,8 @@ func (f *alertsFile) check([]byte) error {
 }
 
 // checkAnomalyCounters refuses an anomaly counter whose scope is not
-// client, net, asn, total or watch, most likely misspelt, and one without
-// a field it needs, as missingFromCounter tells.
+// client, net, asn, total or watched_net, most likely misspelt, and one
+// without a field it needs, as missingFromCounter tells.
 func checkAnomalyCounters(counters []anomaly.Counter) error {
 	for i, counter := range counters {
 		if !slices.Contains(anomaly.Scopes(), counter.Scope) {
@@ -879,9 +879,9 @@ func checkAnomalyCounters(counters []anomaly.Counter) error {
 // missingFromCounter returns the first field counter, an anomaly counter,
 // needs and has not, or "" when it has them all: what tells it from the
 // others in its scope, without which it would never be counted again, the
-// netblock of a client, net or watch counter, the AS number of an asn one
-// and the name of a watch one; and the start of a window in which it has
-// requests or bytes, without which they would be dropped.
+// netblock of a client, net or watched_net counter, the AS number of an
+// asn one and the name of a watched_net one; and the start of a window in
+// which it has requests or bytes, without which they would be dropped.
 func missingFromCounter(counter anomaly.Counter) string {
 	scope := counter.Scope
 
@@ -891,7 +891,7 @@ func missingFromCounter(counter anomaly.Counter) string {
 		return "netblock"
 	case scope == anomaly.ScopeASN && counter.ASN == "":
 		return "asn"
-	case scope == anomaly.ScopeWatch && counter.Name == "":
+	case scope == anomaly.ScopeWatchedNet && counter.Name == "":
 		return "name"
 	case countsWithoutStart(counter.Minute):
 		return "minute.start"