Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/sww/sww_test.go

@@ -962,7 +962,7 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 		metrics := metricsText(t, url+"_sww/metrics", token)
 		for _, series := range []string{
 			`sww_remote_log_lines_sent_total{instance="fsn1app1/blog"} 0`,
-			`sww_remote_log_buffer_depth{instance="fsn1app1/blog"} 1`,
+			`sww_remote_log_lines_waiting{instance="fsn1app1/blog"} 1`,
 		} {
 			if !strings.Contains(metrics, "\n"+series+"\n") {
 				t.Errorf("no %q in the metrics:\n%s", series, metrics)
@@ -1068,8 +1068,12 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 		metrics := metricsWith(t, url+"_sww/metrics", token,
 			"\nsww_alerts_sent_total"+ofWebhook+" 1\n")
 
-		for _, series := range []string{"failed", "suppressed", "dropped"} {
-			zero := "\nsww_alerts_" + series + "_total" + ofWebhook + " 0\n"
+		for _, series := range []string{
+			"sww_alert_send_failures_total",
+			"sww_alerts_suppressed_total",
+			"sww_alerts_dropped_total",
+		} {
+			zero := "\n" + series + ofWebhook + " 0\n"
 			if !strings.Contains(metrics, zero) {
 				t.Errorf("no %q in the metrics:\n%s", zero, metrics)
 			}