Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A client under both a temporary and a permanent ban gets the permanent one.
A request that makes a ban permanent gets permanently_banned. A ban rule, a
trap path or a CrowdSec decision gets the value for the ban it makes, and in
observe mode would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/crowdsec_test.go

@@ -39,7 +39,7 @@ func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testi
 	expires := requestlog.FormatTime(fetched.Add(4 * time.Hour))
 
 	// Its first request is refused, and bans it until the decision ends.
-	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	wantReputation(t, line, decisionsURL)
 
 	if line.BanExpires != expires {
@@ -72,7 +72,7 @@ func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testi
 	// ban, and once it has ended the client is let through.
 	clk.advance(4*time.Hour - time.Second)
 
-	line = s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	line = s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	wantReputation(t, line)
 
 	if line.BanExpires != expires {
@@ -105,7 +105,7 @@ func TestCrowdSecBanNamesItsHeuristicScenarioAndEnd(t *testing.T) {
 		`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
 		`"value": "`+client+`"}]`)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	wantHeuristic(t, line, "crowdsec", `{"scenario": "crowdsecurity/ssh-bf", `+
 		`"expires": "`+requestlog.FormatTime(clk.Now().Add(4*time.Hour))+`"}`)
 	wantTags(t, line, "crowdsec")
@@ -129,9 +129,9 @@ func TestEndedCrowdSecDecisionNoLongerBansThoughTheCopyStillHoldsIt(t *testing.T
 	// Just before its end, the decision bans a client in the netblock, and
 	// one on an IPv6 address bans the address's group, the /64.
 	clk.advance(time.Minute - time.Nanosecond)
-	s.get("198.51.100.7", http.StatusForbidden, requestlog.ActionBanned)
-	s.get("2001:db8::9", http.StatusForbidden, requestlog.ActionBanned)
-	s.get("2001:db8::5", http.StatusForbidden, requestlog.ActionBanned)
+	s.get("198.51.100.7", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get("2001:db8::9", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get("2001:db8::5", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 	// Once it has ended, it bans no other client, and the bans it made end
 	// with it.
@@ -164,7 +164,7 @@ func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
 		`"value": "`+client+`"}]`)
 
 	line := s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionBanned)
+	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
 	wantReputation(t, line, decisionsURL)
 
 	if held := server.Ledger.Snapshot(); len(held) != 0 {