Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

docs/request-log.md

@@ -96,13 +96,15 @@ Every one of these lines has:
 
 - `action`: what was done:
     - `forward`: answered `allow`, so that `rproxy` passes it to the app;
-    - `denied`: refused for `SWW_DENY_NETS`, for a reputation source with the
-      action `deny`, or for a tag in `SWW_TAG_DENY`;
-    - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
-      CrowdSec decision, each of which bans the client;
-    - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
-      refused by that check;
-    - `too_large`: over a header limit;
+    - `client_denied`: refused for `SWW_DENY_NETS`, for a reputation source with
+      the action `deny`, or for a tag in `SWW_TAG_DENY`;
+    - `temporarily_banned`: refused under a ban that runs out, or for a `ban`
+      rule, a trap path or a CrowdSec decision that made such a ban;
+    - `permanently_banned`: refused under a ban that never runs out, or for a
+      request that made such a ban or made its client's ban permanent;
+    - `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
+      `waf_blocked`: refused by that check;
+    - `request_header_too_large`: over a header limit;
     - `admin`: answered at one of `discriminator`'s own endpoints, or `404` for
       a path under `/_sww/`.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a