Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/ratelimits_test.go

@@ -59,7 +59,7 @@ func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 		if sent.want == http.StatusOK {
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 		} else {
-			wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
+			wantLine(t, line, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 			if line.LimitHit != minute {
 				t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
@@ -79,7 +79,7 @@ func TestRateLimitRefusalNamesItsHeuristicWindowCountAndLimit(t *testing.T) {
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	wantHeuristic(t, line, "rate_limits", `{"window": "minute", "count": 2, "limit": 1}`)
 }
 
@@ -102,7 +102,7 @@ func TestIPv6GroupPrefixSetsTheClientTheLimitsCount(t *testing.T) {
 		status int
 		action string
 	}{
-		{rateLimitPerMinute, "1", http.StatusForbidden, requestlog.ActionRateLimited},
+		{rateLimitPerMinute, "1", http.StatusForbidden, requestlog.ActionClientIsRateLimited},
 		{bytesLimitPerMinute, byteLimit, http.StatusOK, requestlog.ActionForward},
 	} {
 		t.Run(tc.setting, func(t *testing.T) {
@@ -160,14 +160,17 @@ func TestRateLimitExemptPathsAreNeitherCountedNorRefused(t *testing.T) {
 
 	// A path outside every prefix is counted: /assets is not under
 	// /assets/, and breaks the limit.
-	s.request(client, "/assets", http.StatusForbidden, requestlog.ActionRateLimited)
+	s.request(client, "/assets", http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited)
 
 	// A ban, SWW_DENY_NETS and SWW_TAG_DENY still refuse a path under a
 	// prefix.
-	s.request(client, "/assets/app.js", http.StatusForbidden, requestlog.ActionBanned)
-	s.request(denied, "/assets/app.js", http.StatusForbidden, requestlog.ActionDenied)
+	s.request(client, "/assets/app.js", http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned)
+	s.request(denied, "/assets/app.js", http.StatusForbidden,
+		requestlog.ActionClientDenied)
 	s.request(fromKP, "/assets/app.js",
-		http.StatusForbidden, requestlog.ActionDenied)
+		http.StatusForbidden, requestlog.ActionClientDenied)
 }
 
 func TestRateLimitCountsPathsThatAreNotExempt(t *testing.T) {
@@ -211,7 +214,7 @@ func TestRateLimitCountsPathsThatAreNotExempt(t *testing.T) {
 			// Counted, the second request breaks the limit of one request
 			// a minute.
 			s.request(client, sent, http.StatusOK, requestlog.ActionForward)
-			s.request(client, sent, http.StatusForbidden, requestlog.ActionRateLimited)
+			s.request(client, sent, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 		})
 	}
 }