Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/metrics/metrics.go

@@ -424,10 +424,10 @@ func (m *Metrics) LimitHit(hit ratelimit.Hit) {
 // them.
 func (m *Metrics) Offences(r ratelimit.Request) {
 	for kind, committed := range map[string]bool{
-		"limit":        r.BrokeLimit,
-		"attack":       r.Attack,
-		"rule_blocked": r.RuleBlocked,
-		"waf_blocked":  r.WAFBlocked,
+		"limit":                 r.BrokeLimit,
+		"attack":                r.Attack,
+		"blocked_by_block_rule": r.BlockedByBlockRule,
+		"waf_blocked":           r.WAFBlocked,
 	} {
 		if committed {
 			m.offences.WithLabelValues(kind).Inc()