Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

README.md

@@ -173,7 +173,7 @@ does.
   the request have `"action":"forward"`.
 - To see a refusal without banning yourself, run `discriminator` with
   `SWW_MODE=observe` and ask for `/.env`. The request reaches the app.
-  `discriminator`'s log lines have `"would_action":"banned"` and
+  `discriminator`'s log lines have `"would_action":"temporarily_banned"` and
   `"rule_ids":["env-file"]`. A ban you get in `enforce` mode is lifted as
   "Clients and bans" below describes.
 - With `SWW_METRICS_TOKEN` set, this answers with the metrics, from a host on