Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A client under both a temporary and a permanent ban gets the permanent one.
A request that makes a ban permanent gets permanently_banned. A ban rule, a
trap path or a CrowdSec decision gets the value for the ban it makes, and in
observe mode would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/bytelimits_test.go

@@ -90,7 +90,7 @@ func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 					line.BanExpires, tc.window, expires)
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 			wantMetric(t, s.scrape(), `sww_rate_limit_hits_total{`+
 				`instance="`+alertInstance+`",kind="bytes",window="`+tc.window+`"}`, 1)
@@ -125,7 +125,7 @@ func TestResponseOverAByteLimitByItselfIsPassedOnWhole(t *testing.T) {
 			len(got.body), got.err, line.LimitHit, answerBytes, minuteBytes)
 	}
 
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
 func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
@@ -147,7 +147,7 @@ func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
 			answerBytes, minuteBytes, expires)
 	}
 
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
 func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
@@ -176,7 +176,7 @@ func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
 					line.LimitHit, line.Counts.MinuteBytes, minuteBytes, tc.counted)
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 		})
 	}
 }
@@ -218,7 +218,7 @@ func TestBytesCountSaysWhichBytesCount(t *testing.T) {
 				}
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 		})
 	}
 }
@@ -386,7 +386,7 @@ func TestObserveModeLeavesOutTheBytesOfARequestEnforceModeRefuses(t *testing.T)
 	// counted, and the byte limit is not broken. Its line gives the bytes
 	// counted before it.
 	line := s.upload()
-	wantWouldAction(t, line, requestlog.ActionRateLimited)
+	wantWouldAction(t, line, requestlog.ActionClientIsRateLimited)
 
 	if line.LimitHit != minute || line.Counts.MinuteBytes != bodyBytes+answerBytes {
 		t.Errorf("log line has limit_hit %q and minute_bytes %v, want minute and %d",