Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/crowdsec.go

@@ -30,10 +30,9 @@ func (crowdSec) check(_ context.Context, rq *request, now time.Time) *verdict {
 	rq.addTag(config.CrowdSecTag)
 	rq.noteHit(bans.ReputationHit{Source: rq.h.config.CrowdSecDecisionsURL},
 		"listed by the CrowdSec decision list")
-	rq.banForCrowdSec(now, decision)
 
 	return &verdict{
-		action: requestlog.ActionBanned,
+		action: rq.banForCrowdSec(now, decision),
 		figures: map[string]any{
 			"scenario": decision.Scenario,
 			"expires":  requestlog.FormatTime(decision.Expires),