Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A client under both a temporary and a permanent ban gets the permanent one.
A request that makes a ban permanent gets permanently_banned. A ban rule, a
trap path or a CrowdSec decision gets the value for the ban it makes, and in
observe mode would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/bans/admin_test.go

@@ -341,3 +341,48 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 
 	wantChanged(t, ledger, false)
 }
+
+func TestPermanentBanOnAWiderNetblockIsReturnedOverATemporaryBan(t *testing.T) {
+	t.Parallel()
+
+	client := netip.MustParseAddr("203.0.113.9")
+	ledger := bans.New(defaultRules())
+
+	// The temporary ban is made first, so that its netblock is looked at first.
+	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(), bans.Notes{})
+	ledger.BanForAdmin(netip.MustParsePrefix("203.0.113.0/24"), midnight(), time.Time{},
+		"for good")
+
+	wantPermanentBan(t, ledger, client, midnight().Add(time.Minute))
+}
+
+func TestOlderPermanentBanIsReturnedOverANewerTemporaryBan(t *testing.T) {
+	t.Parallel()
+
+	netblock := netip.MustParsePrefix("203.0.113.0/24")
+	ledger := bans.New(defaultRules())
+
+	ledger.BanForAdmin(netblock, midnight(), time.Time{}, "for good")
+	ledger.BanForAdmin(netblock, midnight().Add(time.Minute), midnight().Add(time.Hour),
+		"for an hour")
+
+	wantPermanentBan(t, ledger, netblock.Addr(), midnight().Add(2*time.Minute))
+}
+
+// wantPermanentBan checks that Find and Check return a permanent ban for
+// client at now.
+func wantPermanentBan(
+	t *testing.T, ledger *bans.Ledger, client netip.Addr, now time.Time,
+) {
+	t.Helper()
+
+	for name, look := range map[string]func(netip.Addr, time.Time) (bans.Ban, bool, bool){
+		"Find":  ledger.Find,
+		"Check": ledger.Check,
+	} {
+		ban, banned, _ := look(client, now)
+		if !banned || !ban.Permanent() {
+			t.Errorf("%s returned %+v and banned %v, want a permanent ban", name, ban, banned)
+		}
+	}
+}