Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/abuseipdb.go

@@ -50,7 +50,7 @@ func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 	}
 
 	return &verdict{
-		action: requestlog.ActionDenied,
+		action: requestlog.ActionClientDenied,
 		figures: map[string]any{
 			figureScore: score, "min_score": rq.h.config.AbuseIPDBMinScore,
 		},