Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/anomaly_test.go

@@ -187,7 +187,7 @@ func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
 		{allowed, "/", http.StatusOK, requestlog.ActionForward},
 		{exempt, "/", http.StatusOK, requestlog.ActionForward},
 		{client, "/static/app.js", http.StatusOK, requestlog.ActionForward},
-		{denied, "/", http.StatusForbidden, requestlog.ActionDenied},
+		{denied, "/", http.StatusForbidden, requestlog.ActionClientDenied},
 	} {
 		for range 3 {
 			s.request(sent.from, sent.path, sent.status, sent.action)