Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A client under both a temporary and a permanent ban gets the permanent one.
A request that makes a ban permanent gets permanently_banned. A ban rule, a
trap path or a CrowdSec decision gets the value for the ban it makes, and in
observe mode would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/coreruleset_test.go

@@ -92,7 +92,8 @@ func TestDetectedAttackIsRefusedByTagDenyLast(t *testing.T) {
 		wafMode: detect, tagDeny: "exploitsignature",
 	})
 
-	line := s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionDenied)
+	line := s.request(client, sqlInjection, http.StatusForbidden,
+		requestlog.ActionClientDenied)
 	wantHeuristic(t, line, "tag_deny", `{"tag": "exploitsignature"}`)
 }
 
@@ -195,7 +196,7 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 
 	// A request a rule file refuses is not inspected.
 	line = s.request(otherClient, "/blocked?id=1'%20OR%20'1'='1", http.StatusForbidden,
-		requestlog.ActionRuleBlocked)
+		requestlog.ActionBlockedByBlockRule)
 	wantWAF(t, line, nil)
 
 	// With SWW_WAF_MODE off, no request is.
@@ -403,7 +404,7 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 			line.LimitHit, line.Offence)
 	}
 
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 	want := ratelimit.Offences{Limit: 1, WAFBlocked: 3}
 	if offences := historyOf(t, server, client).Offences; offences != want {