Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A client under both a temporary and a permanent ban gets the permanent one.
A request that makes a ban permanent gets permanently_banned. A ban rule, a
trap path or a CrowdSec decision gets the value for the ban it makes, and in
observe mode would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/staticlists_test.go

@@ -68,7 +68,7 @@ func TestRequestFromAllowNetsIsNotCounted(t *testing.T) {
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
 	})
 }
 
@@ -92,7 +92,7 @@ func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
 	wantStatus(t, do(t, req), http.StatusForbidden)
 
 	line := out.endedLine(t)
-	wantLine(t, line, http.StatusForbidden, requestlog.ActionDenied)
+	wantLine(t, line, http.StatusForbidden, requestlog.ActionClientDenied)
 
 	if len(asked()) != 0 {
 		t.Errorf("GeoJS was asked about %v, want nothing", asked())
@@ -108,7 +108,7 @@ func TestDenyNetsRefusalNamesItsHeuristicAndNetblock(t *testing.T) {
 
 	s, _, _ := startWithClock(t, "", map[string]string{denyNets: clientsNet})
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionDenied)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionClientDenied)
 	wantHeuristic(t, line, "deny_nets", `{"netblock": "`+clientsNet+`"}`)
 }
 
@@ -125,10 +125,10 @@ func TestRequestRefusedByDenyNetsIsNotCounted(t *testing.T) {
 	// listedAddr's refused requests are not counted, so the first request
 	// from unlistedAddr is within the limit of one a minute.
 	wantAnswers(t, addr, out, []sentRequest{
-		{listedAddr, http.StatusForbidden, requestlog.ActionDenied},
-		{listedAddr, http.StatusForbidden, requestlog.ActionDenied},
+		{listedAddr, http.StatusForbidden, requestlog.ActionClientDenied},
+		{listedAddr, http.StatusForbidden, requestlog.ActionClientDenied},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
 	})
 }
 
@@ -152,8 +152,8 @@ func TestRateLimitExemptNetsAreNeitherCountedNorRefused(t *testing.T) {
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
-		{fromKP, http.StatusForbidden, requestlog.ActionDenied},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
+		{fromKP, http.StatusForbidden, requestlog.ActionClientDenied},
 	})
 }