Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

internal/discriminator/request.go

@@ -54,10 +54,10 @@ type decision struct {
 	counted                    bool
 	limitPercent, bytesPercent percentage
 	// attack is true for a request that matched a ban rule or asked for a
-	// trap path, ruleBlocked for one a block rule refused, and wafBlocked for
-	// one the Core Rule Set refused, each an offence its client's history
-	// counts.
-	attack, ruleBlocked, wafBlocked bool
+	// trap path, blockedByBlockRule for one a block rule refused, and
+	// wafBlocked for one the Core Rule Set refused, each an offence its
+	// client's history counts.
+	attack, blockedByBlockRule, wafBlocked bool
 	// reputation is the reputation sources that list the client, for the
 	// notes of a ban the request makes.
 	reputation []bans.ReputationHit
@@ -187,9 +187,10 @@ func (rq *request) check(ctx context.Context) *refusal {
 		rq.line.WouldAction = action
 
 		return nil
-	case action == requestlog.ActionRuleBlocked || action == requestlog.ActionWAFBlocked:
+	case action == requestlog.ActionBlockedByBlockRule ||
+		action == requestlog.ActionWAFBlocked:
 		return &refusal{status: http.StatusForbidden, action: action}
-	case action == requestlog.ActionTooLarge:
+	case action == requestlog.ActionRequestHeaderTooLarge:
 		return &refusal{status: http.StatusRequestHeaderFieldsTooLarge, action: action}
 	default:
 		return rq.banResponse(action)
@@ -303,15 +304,15 @@ func timing(start, end time.Time) *float64 {
 // when it comes.
 func (rq *request) addToHistory() {
 	request := ratelimit.Request{
-		Forwarded:     rq.allowed,
-		Refused:       rq.refused != nil,
-		Status:        rq.out.status,
-		RequestBytes:  rq.requestBytes,
-		ResponseBytes: rq.out.bytes,
-		BrokeLimit:    rq.line.Offence == requestlog.OffenceLimit,
-		Attack:        rq.attack,
-		RuleBlocked:   rq.ruleBlocked,
-		WAFBlocked:    rq.wafBlocked,
+		Forwarded:          rq.allowed,
+		Refused:            rq.refused != nil,
+		Status:             rq.out.status,
+		RequestBytes:       rq.requestBytes,
+		ResponseBytes:      rq.out.bytes,
+		BrokeLimit:         rq.line.Offence == requestlog.OffenceLimit,
+		Attack:             rq.attack,
+		BlockedByBlockRule: rq.blockedByBlockRule,
+		WAFBlocked:         rq.wafBlocked,
 	}
 
 	rq.h.limiter.AddToHistory(rq.h.clientGroup(rq.client), rq.h.now(), request)