Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A client under both a temporary and a permanent ban gets the permanent one.
A request that makes a ban permanent gets permanently_banned. A ban rule, a
trap path or a CrowdSec decision gets the value for the ban it makes, and in
observe mode would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/alerts_test.go

@@ -31,14 +31,14 @@ func TestBanForABrokenLimitRaisesABanAlertWithItsNotes(t *testing.T) {
 	start := clk.Now()
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	netblock := netip.MustParsePrefix("203.0.113.0/24")
 	ban := server.Ledger.Bans(netblock)[0]
 
 	// A request refused under the ban raises no other alert.
 	clk.advance(time.Minute)
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 	wantAlerts(t, queue, banAlert(alerts.EventBan, start, client, bans.Ban{
 		Netblock: netblock, Cause: bans.CauseLimit,
@@ -62,22 +62,24 @@ func TestAttackBanRaisesABanAlertThenAPermanentBanAlert(t *testing.T) {
 
 	// The probe bans the client for seven days, and its next request makes
 	// the ban permanent. The request after that changes nothing.
-	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 	attackBan := server.Ledger.Bans(netblock)[0]
 
 	clk.advance(time.Minute)
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
 
 	permanentBan := server.Ledger.Bans(netblock)[0]
 
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
 
 	// Another client's probe after its first ban has run out without a
 	// request makes a permanent ban at once.
-	s.request(otherClient, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(otherClient, "/.env", http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned)
 	clk.advance(7 * 24 * time.Hour)
-	s.request(otherClient, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(otherClient, "/.env", http.StatusForbidden,
+		requestlog.ActionPermanentlyBanned)
 
 	otherBans := server.Ledger.Bans(other)