Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A client under both a temporary and a permanent ban gets the permanent one.
A request that makes a ban permanent gets permanently_banned. A ban rule, a
trap path or a CrowdSec decision gets the value for the ban it makes, and in
observe mode would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/sww/sww_test.go

@@ -373,13 +373,13 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
 	out := runUntilStopped(t, env, func(url string) {
 		wantRefused(t, url)
 	})
-	out.line(t, "action", "rate_limited")
+	out.line(t, "action", "client_is_rate_limited")
 
 	// After another, the ban still refuses it.
 	out = runUntilStopped(t, env, func(url string) {
 		wantRefused(t, url)
 	})
-	out.line(t, "action", "banned")
+	out.line(t, "action", "temporarily_banned")
 }
 
 func TestBanRefusesItsNetblockAfterARestartWithAnotherScope(t *testing.T) {
@@ -526,7 +526,7 @@ func TestRuleFileAddedWhileRunningTakesEffect(t *testing.T) {
 			time.Sleep(pollInterval)
 		}
 	})
-	out.line(t, "action", "rule_blocked")
+	out.line(t, "action", "blocked_by_block_rule")
 }
 
 func TestRuleFileThatDoesNotParseStopsTheStart(t *testing.T) {
@@ -740,7 +740,7 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 			time.Sleep(pollInterval)
 		}
 	})
-	wantDeniedByList(t, out.line(t, "action", "denied"), dropURL)
+	wantDeniedByList(t, out.line(t, "action", "client_denied"), dropURL)
 
 	if fetches := torFetches.Load(); fetches != 1 {
 		t.Errorf("tor.txt fetched %d times, want once, before the restart", fetches)
@@ -843,7 +843,8 @@ func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {
 	t.Helper()
 
 	reputation, _ := line["reputation"].([]any)
-	if line["action"] != "denied" || len(reputation) != 1 || reputation[0] != listURL {
+	if line["action"] != "client_denied" || len(reputation) != 1 ||
+		reputation[0] != listURL {
 		t.Errorf("request log line %v, want one denied for %s", line, listURL)
 	}
 }