Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

internal/discriminator/biased_test.go

@@ -76,7 +76,7 @@ func TestEachBiasedThresholdLowersTheRateLimits(t *testing.T) {
 			}{
 				{http.StatusOK, requestlog.ActionForward},
 				{http.StatusOK, requestlog.ActionForward},
-				{http.StatusForbidden, requestlog.ActionRateLimited},
+				{http.StatusForbidden, requestlog.ActionClientIsRateLimited},
 			} {
 				line := s.get(tc.from, sent.status, sent.action)
 				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
@@ -192,7 +192,7 @@ func TestZeroPercentIsAZeroAllowance(t *testing.T) {
 
 	// The first request breaks the limit, and bans the client; the log line
 	// gives the 0.
-	line := s.get(unplaced, http.StatusForbidden, requestlog.ActionRateLimited)
+	line := s.get(unplaced, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	if line.fields["limit_percent"] != float64(0) ||
 		line.fields["limit_percent_setting"] != unknownLimitPercent {
 		t.Errorf("log line has limit_percent %v from %v, want 0 from %s",
@@ -200,7 +200,7 @@ func TestZeroPercentIsAZeroAllowance(t *testing.T) {
 			unknownLimitPercent)
 	}
 
-	s.get(unplaced, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(unplaced, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
 func TestLowestPercentageApplies(t *testing.T) {
@@ -250,7 +250,7 @@ func TestLowestPercentageApplies(t *testing.T) {
 			// A quarter of 4 requests a minute: the second breaks the limit.
 			s.get(tc.from, http.StatusOK, requestlog.ActionForward)
 
-			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionRateLimited)
+			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
 				tc.want)
 		})
@@ -269,7 +269,7 @@ func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(t *test
 	for _, from := range []string{unplaced, "10.0.0.8"} {
 		s.get(from, http.StatusOK, requestlog.ActionForward)
 		s.get(from, http.StatusOK, requestlog.ActionForward)
-		s.get(from, http.StatusForbidden, requestlog.ActionRateLimited)
+		s.get(from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	}
 
 	// One in a country has the whole limit.
@@ -293,7 +293,7 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 		serveFromDE(t, server, http.MethodGet, http.NoBody)
 
 		line := out.requestLine(t)
-		wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
+		wantLine(t, line, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 		wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
 			"0 from "+unknownLimitPercent)
 	})
@@ -374,7 +374,7 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 			// A quarter of 12 requests a minute is 3: the fourth breaks it.
 			"a rate limit",
 			map[string]string{rateLimitPerMinute: "12", tagLimitPercent: asnTagDEQuarter},
-			3, http.StatusForbidden, requestlog.ActionRateLimited,
+			3, http.StatusForbidden, requestlog.ActionClientIsRateLimited,
 			"requests per minute over the limit of 3", "25 from " + tagLimitPercent,
 		},
 		{