Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

internal/discriminator/trappaths.go

@@ -8,7 +8,6 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
@@ -30,10 +29,9 @@ func (trapPaths) check(_ context.Context, rq *request, now time.Time) *verdict {
 	}
 
 	rq.attack = true
-	rq.banForAttack(now, bans.Notes{TrapPath: path})
 
 	return &verdict{
-		action:  requestlog.ActionBanned,
+		action:  rq.banForAttack(now, bans.Notes{TrapPath: path}),
 		figures: map[string]any{"path": path},
 	}
 }