Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/discriminator/refusallimit.go

@@ -28,7 +28,7 @@ func (refusalLimit) check(_ context.Context, rq *request, now time.Time) *verdic
 		return nil
 	}
 
-	if !rq.attack && !rq.ruleBlocked && !rq.wafBlocked {
+	if !rq.attack && !rq.blockedByBlockRule && !rq.wafBlocked {
 		return nil
 	}
 
@@ -42,13 +42,11 @@ func (refusalLimit) check(_ context.Context, rq *request, now time.Time) *verdic
 	status := rq.out.status
 
 	switch rq.line.WouldAction {
-	case requestlog.ActionRuleBlocked, requestlog.ActionWAFBlocked:
+	case requestlog.ActionBlockedByBlockRule, requestlog.ActionWAFBlocked:
 		status = http.StatusForbidden
-	case requestlog.ActionBanned:
+	case requestlog.ActionTemporarilyBanned, requestlog.ActionPermanentlyBanned:
 		status = cfg.BanResponse
 	}
 
-	rq.banForLimit(now, hit, status)
-
-	return &verdict{action: requestlog.ActionBanned, figures: limitFigures(hit)}
+	return &verdict{action: rq.banForLimit(now, hit, status), figures: limitFigures(hit)}
 }