Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

Log field, metric, action and event names now say what they count
and, for timings, the unit. Package internal/waf is internal/coreruleset.

Model: opus-5-5

docs/settings.md

@@ -324,7 +324,7 @@ the request first.
 - `SWW_ALERT_NTFY_TOKEN` (default unset): an ntfy access token. A control
   character in it is refused.
 - `SWW_ALERT_EVENTS` (default
-  `ban,permanent_ban,waf_block,anomaly,reputation_hit,source_failure,file_error`):
+  `ban,permanent_ban,core_rule_set_match,anomaly,reputation_hit,source_failure,file_error`):
   the event types alerts are sent for, from those in [`alerts.md`](alerts.md)
   but `summary`. Any other name is refused.
 - `SWW_ALERT_COOLDOWN` (default `15m`): how long after an alert is sent its