Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/bytelimits.go

@@ -6,8 +6,6 @@ package discriminator
 import (
 	"context"
 	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
 // byteLimits counts the request's bytes, as countedBytes gives them, for the
@@ -37,7 +35,7 @@ func (byteLimits) check(_ context.Context, rq *request, now time.Time) *verdict
 		return nil
 	}
 
-	rq.banForLimit(now, hit, rq.out.status)
-
-	return &verdict{action: requestlog.ActionBanned, figures: limitFigures(hit)}
+	return &verdict{
+		action: rq.banForLimit(now, hit, rq.out.status), figures: limitFigures(hit),
+	}
 }