Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

internal/discriminator/coreruleset_test.go

@@ -92,7 +92,8 @@ func TestDetectedAttackIsRefusedByTagDenyLast(t *testing.T) {
 		wafMode: detect, tagDeny: "exploitsignature",
 	})
 
-	line := s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionDenied)
+	line := s.request(client, sqlInjection, http.StatusForbidden,
+		requestlog.ActionClientDenied)
 	wantHeuristic(t, line, "tag_deny", `{"tag": "exploitsignature"}`)
 }
 
@@ -195,7 +196,7 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 
 	// A request a rule file refuses is not inspected.
 	line = s.request(otherClient, "/blocked?id=1'%20OR%20'1'='1", http.StatusForbidden,
-		requestlog.ActionRuleBlocked)
+		requestlog.ActionBlockedByBlockRule)
 	wantWAF(t, line, nil)
 
 	// With SWW_WAF_MODE off, no request is.
@@ -403,7 +404,7 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 			line.LimitHit, line.Offence)
 	}
 
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 	want := ratelimit.Offences{Limit: 1, WAFBlocked: 3}
 	if offences := historyOf(t, server, client).Offences; offences != want {