Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

Log field, metric, action and event names now say what they count
and, for timings, the unit. Package internal/waf is internal/coreruleset.

Model: opus-5-5

internal/state/state_test.go

@@ -208,7 +208,7 @@ const filledAlertsJSON = `{
             }
         },
         {
-            "scope": "watch",
+            "scope": "watched_net",
             "netblock": "203.0.113.0/24",
             "name": "office",
             "hour": {
@@ -534,7 +534,7 @@ func TestFileThatDoesNotParseStopsTheStart(t *testing.T) {
 			`{"version": 1, "anomaly_counters": [{"scope": "total"}, ` +
 				`{"scope": "nett", "netblock": "203.0.113.0/24"}]}`,
 			`: anomaly_counters entry 2's scope "nett" is not client, net, asn, total ` +
-				`or watch`,
+				`or watched_net`,
 		},
 		{
 			"a copy of a list with a line that does not read", reputationJSON,
@@ -831,12 +831,12 @@ func TestAlertsJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 		{
 			"an anomaly counter of a named netblock without its name",
 			`{"version": 1, "anomaly_counters": [` +
-				`{"scope": "watch", "netblock": "203.0.113.0/24"}]}`,
+				`{"scope": "watched_net", "netblock": "203.0.113.0/24"}]}`,
 			`: anomaly_counters entry 1 has no "name"`,
 		},
 		{
 			"an anomaly counter of a named netblock without its netblock",
-			`{"version": 1, "anomaly_counters": [{"scope": "watch", "name": "office"}]}`,
+			`{"version": 1, "anomaly_counters": [{"scope": "watched_net", "name": "office"}]}`,
 			`: anomaly_counters entry 1 has no "netblock"`,
 		},
 		{
@@ -1729,7 +1729,7 @@ func newParams(dir string) state.Params {
 		Dir:             dir,
 		WriteDelay:      time.Hour,
 		CounterInterval: time.Hour,
-		Ledger: bans.New(bans.Rules{
+		Ledger: bans.New(bans.Params{
 			LimitBanDuration:     time.Hour,
 			LimitBanRepeatWindow: 24 * time.Hour,
 			MaxBanDuration:       7 * 24 * time.Hour,