Name request log actions so they say what they mean (closes #229)

The request log's `action` values now say what they mean, as sneak named them: `request_header_too_large`, `client_is_rate_limited`, `blocked_by_block_rule` and `client_denied`, with no aliases. `banned` splits into `temporarily_banned` and `permanently_banned`, by whether the ban runs out. When a permanent ban also covers a client, that ban is the one reported.

Trips a reader: a request over a rate limit stays `client_is_rate_limited` even when the ban it makes is permanent.
Disclosure: the offence key `rule_blocked` is renamed in `clients.json` too, so an existing file holding it stops the start and must be removed. Its `version` stays 1.

Model: opus-5-5

script/example-app

@@ -187,15 +187,16 @@ main() {
     echo "example-app: rproxy passes a request to the app and its answer back"
 
     refused || fail "a second request in a minute was not refused"
-    wait_for "discriminator logged no ban" logged "$DISCRIMINATOR" '"action":"rate_limited"'
+    wait_for "discriminator logged no ban" \
+        logged "$DISCRIMINATOR" '"action":"client_is_rate_limited"'
     echo "example-app: a second request in a minute bans the client"
 
     refused_from 203.0.113.9 /.env || fail "a probe for /.env was not refused"
     wait_for "discriminator logged no ban for the probe" \
-        logged "$DISCRIMINATOR" '"action":"banned"' '"rule_ids":["env-file"]'
+        logged "$DISCRIMINATOR" '"action":"temporarily_banned"' '"rule_ids":["env-file"]'
     refused_from 203.0.113.9 / || fail "the client of the probe was let through"
     wait_for "the client's next request did not make its ban permanent" \
-        logged "$DISCRIMINATOR" '"ban_expires":"permanent"'
+        logged "$DISCRIMINATOR" '"action":"permanently_banned"' '"ban_expires":"permanent"'
     echo "example-app: a probe for /.env bans the client, its next request for good"
 
     docker exec "$DISCRIMINATOR" sv stop sww >/dev/null ||
@@ -232,7 +233,7 @@ main() {
     start_app
     refused || fail "the new discriminator container let the banned client through"
     wait_for "discriminator logged no request refused under the ban" \
-        logged "$DISCRIMINATOR" '"action":"banned"'
+        logged "$DISCRIMINATOR" '"action":"temporarily_banned"'
     echo "example-app: a new discriminator container on the same volume keeps the ban"
 
     docker rm --force "$DISCRIMINATOR" >/dev/null