Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

internal/requestlog/requestlog.go

@@ -20,32 +20,37 @@ const (
 	// the app.
 	ActionForward = "forward"
 
-	// ActionTooLarge is a request over the header limits.
-	ActionTooLarge = "too_large"
+	// ActionRequestHeaderTooLarge is a request over the header limits.
+	ActionRequestHeaderTooLarge = "request_header_too_large"
 
-	// ActionRateLimited is a request refused because it took its client
-	// over a rate limit, which bans the client.
-	ActionRateLimited = "rate_limited"
+	// ActionClientIsRateLimited is a request refused because it took its
+	// client over a rate limit, which bans the client.
+	ActionClientIsRateLimited = "client_is_rate_limited"
 
-	// ActionBanned is a request refused because a ban covers its client,
-	// or because it matched a ban rule, asked for a trap path or the
-	// CrowdSec decision list lists its client, each of which bans the
-	// client.
-	ActionBanned = "banned"
+	// ActionTemporarilyBanned is a request refused because a ban that runs
+	// out covers its client, or because it matched a ban rule, asked for a
+	// trap path or the CrowdSec decision list lists its client, and so made
+	// such a ban.
+	ActionTemporarilyBanned = "temporarily_banned"
 
-	// ActionRuleBlocked is a request refused because it matched a block
-	// rule.
-	ActionRuleBlocked = "rule_blocked"
+	// ActionPermanentlyBanned is a request refused because a ban that never
+	// runs out covers its client, or because the request made such a ban or
+	// made its client's ban permanent.
+	ActionPermanentlyBanned = "permanently_banned"
+
+	// ActionBlockedByBlockRule is a request refused because it matched a
+	// block rule.
+	ActionBlockedByBlockRule = "blocked_by_block_rule"
 
 	// ActionWAFBlocked is a request refused because the Core Rule Set
 	// scored it at or over SWW_WAF_ANOMALY_THRESHOLD.
 	ActionWAFBlocked = "waf_blocked"
 
-	// ActionDenied is a request refused because its client is in
+	// ActionClientDenied is a request refused because its client is in
 	// SWW_DENY_NETS, in a blocklist while SWW_BLOCKLIST_ACTION is deny,
 	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
 	// SWW_REPUTATION_ACTION is deny, or that carries a tag in SWW_TAG_DENY.
-	ActionDenied = "denied"
+	ActionClientDenied = "client_denied"
 
 	// ActionCountryDenied is a request refused because its client's country
 	// is not in SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
@@ -134,10 +139,10 @@ type Line struct {
 	// The decision.
 	Action string `json:"action"`
 	// WouldAction is, in observe mode, the action enforce mode would have
-	// taken with a request it would have refused: ActionDenied,
-	// ActionBanned, ActionCountryDenied, ActionRateLimited,
-	// ActionRuleBlocked, ActionWAFBlocked, or, in discriminator, ActionTooLarge
-	// for the header limits.
+	// taken with a request it would have refused: ActionClientDenied,
+	// ActionTemporarilyBanned, ActionPermanentlyBanned, ActionCountryDenied,
+	// ActionClientIsRateLimited, ActionBlockedByBlockRule, ActionWAFBlocked,
+	// or, in discriminator, ActionRequestHeaderTooLarge for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
 	// Heuristic is the name of the heuristic that refused the request, in
 	// observe mode too, and HeuristicFigures are the figures it acted on, by