Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

docs/state-files.md

@@ -63,8 +63,9 @@ since it was first seen:
 - total requests, and how many were forwarded and how many refused;
 - body bytes of its requests, and of the responses it was sent;
 - responses by status class;
-- offences by kind: `limit`, `attack`, `rule_blocked` and `waf_blocked`. A file
-  may also hold `token_refused`, which is kept, and which nothing adds to.
+- offences by kind: `limit`, `attack`, `blocked_by_block_rule` and
+  `waf_blocked`. A file may also hold `token_refused`, which is kept, and which
+  nothing adds to.
 
 ## `lookups.json`