Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/ratelimit/ratelimit.go

@@ -122,12 +122,12 @@ type Responses struct {
 type Offences struct {
 	// Limit is its requests that broke a rate limit, a byte limit or the
 	// error burst, Attack those that were a clear sign of attack, a match
-	// of a ban rule or a request for a trap path, RuleBlocked those a block
-	// rule refused, and WAFBlocked those the Core Rule Set refused.
-	Limit       int64 `json:"limit"`
-	Attack      int64 `json:"attack"`
-	RuleBlocked int64 `json:"rule_blocked"`
-	WAFBlocked  int64 `json:"waf_blocked"`
+	// of a ban rule or a request for a trap path, BlockedByBlockRule those a
+	// block rule refused, and WAFBlocked those the Core Rule Set refused.
+	Limit              int64 `json:"limit"`
+	Attack             int64 `json:"attack"`
+	BlockedByBlockRule int64 `json:"blocked_by_block_rule"`
+	WAFBlocked         int64 `json:"waf_blocked"`
 	// TokenRefused is what a clients.json written by an earlier version gives,
 	// which must still load. Nothing adds to it.
 	TokenRefused int64 `json:"token_refused,omitempty"`
@@ -147,12 +147,12 @@ type Request struct {
 	ResponseBytes int64
 	// BrokeLimit is true for a request that broke a rate limit, a byte
 	// limit or the error burst, Attack for one that matched a ban rule or
-	// asked for a trap path, RuleBlocked for one a block rule refused, and
-	// WAFBlocked for one the Core Rule Set refused.
-	BrokeLimit  bool
-	Attack      bool
-	RuleBlocked bool
-	WAFBlocked  bool
+	// asked for a trap path, BlockedByBlockRule for one a block rule refused,
+	// and WAFBlocked for one the Core Rule Set refused.
+	BrokeLimit         bool
+	Attack             bool
+	BlockedByBlockRule bool
+	WAFBlocked         bool
 }
 
 // New returns a Limiter for limits, with no client counted yet, whose
@@ -323,8 +323,8 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 		h.Offences.Attack++
 	}
 
-	if r.RuleBlocked {
-		h.Offences.RuleBlocked++
+	if r.BlockedByBlockRule {
+		h.Offences.BlockedByBlockRule++
 	}
 
 	if r.WAFBlocked {