Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

internal/discriminator/rulefiles.go

@@ -16,9 +16,10 @@ import (
 // ruleFiles checks the request against the rules of the rule files at now,
 // notes the ids of those it matches in the log line, adds the tag
 // exploitsignature when it matches any, and refuses the request
-// when the last rule it matches refuses it: with ActionRuleBlocked for a block
-// rule, and ActionBanned for a ban rule. A ban rule bans the client's netblock
-// for a clear sign of attack, or in observe mode raises the alert for the ban
+// when the last rule it matches refuses it: with ActionBlockedByBlockRule for a
+// block rule, and for a ban rule with the action for the ban it makes. A ban
+// rule bans the client's netblock for a clear sign of attack, or in observe
+// mode raises the alert for the ban
 // it would have made. Either rule's match is noted as an offence, for the
 // client's history. Its figures are the rule's id and action.
 type ruleFiles struct{}
@@ -45,14 +46,16 @@ func (ruleFiles) check(_ context.Context, rq *request, now time.Time) *verdict {
 
 	switch last.Action {
 	case rules.ActionBlock:
-		rq.ruleBlocked = true
+		rq.blockedByBlockRule = true
 
-		return &verdict{action: requestlog.ActionRuleBlocked, figures: figures}
+		return &verdict{action: requestlog.ActionBlockedByBlockRule, figures: figures}
 	case rules.ActionBan:
 		rq.attack = true
-		rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target})
 
-		return &verdict{action: requestlog.ActionBanned, figures: figures}
+		return &verdict{
+			action:  rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target}),
+			figures: figures,
+		}
 	default:
 		return nil
 	}