Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

internal/sww/sww_test.go

@@ -373,13 +373,13 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
 	out := runUntilStopped(t, env, func(url string) {
 		wantRefused(t, url)
 	})
-	out.line(t, "action", "rate_limited")
+	out.line(t, "action", "client_is_rate_limited")
 
 	// After another, the ban still refuses it.
 	out = runUntilStopped(t, env, func(url string) {
 		wantRefused(t, url)
 	})
-	out.line(t, "action", "banned")
+	out.line(t, "action", "temporarily_banned")
 }
 
 func TestBanRefusesItsNetblockAfterARestartWithAnotherScope(t *testing.T) {
@@ -526,7 +526,7 @@ func TestRuleFileAddedWhileRunningTakesEffect(t *testing.T) {
 			time.Sleep(pollInterval)
 		}
 	})
-	out.line(t, "action", "rule_blocked")
+	out.line(t, "action", "blocked_by_block_rule")
 }
 
 func TestRuleFileThatDoesNotParseStopsTheStart(t *testing.T) {
@@ -740,7 +740,7 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 			time.Sleep(pollInterval)
 		}
 	})
-	wantDeniedByList(t, out.line(t, "action", "denied"), dropURL)
+	wantDeniedByList(t, out.line(t, "action", "client_denied"), dropURL)
 
 	if fetches := torFetches.Load(); fetches != 1 {
 		t.Errorf("tor.txt fetched %d times, want once, before the restart", fetches)
@@ -843,7 +843,8 @@ func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {
 	t.Helper()
 
 	reputation, _ := line["reputation"].([]any)
-	if line["action"] != "denied" || len(reputation) != 1 || reputation[0] != listURL {
+	if line["action"] != "client_denied" || len(reputation) != 1 ||
+		reputation[0] != listURL {
 		t.Errorf("request log line %v, want one denied for %s", line, listURL)
 	}
 }