Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A request that makes a ban permanent gets permanently_banned. A ban the
request itself makes gets the value for that ban, and in observe mode
would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

script/example-app

@@ -187,15 +187,16 @@ main() {
     echo "example-app: rproxy passes a request to the app and its answer back"
 
     refused || fail "a second request in a minute was not refused"
-    wait_for "discriminator logged no ban" logged "$DISCRIMINATOR" '"action":"rate_limited"'
+    wait_for "discriminator logged no ban" \
+        logged "$DISCRIMINATOR" '"action":"client_is_rate_limited"'
     echo "example-app: a second request in a minute bans the client"
 
     refused_from 203.0.113.9 /.env || fail "a probe for /.env was not refused"
     wait_for "discriminator logged no ban for the probe" \
-        logged "$DISCRIMINATOR" '"action":"banned"' '"rule_ids":["env-file"]'
+        logged "$DISCRIMINATOR" '"action":"temporarily_banned"' '"rule_ids":["env-file"]'
     refused_from 203.0.113.9 / || fail "the client of the probe was let through"
     wait_for "the client's next request did not make its ban permanent" \
-        logged "$DISCRIMINATOR" '"ban_expires":"permanent"'
+        logged "$DISCRIMINATOR" '"action":"permanently_banned"' '"ban_expires":"permanent"'
     echo "example-app: a probe for /.env bans the client, its next request for good"
 
     docker exec "$DISCRIMINATOR" sv stop sww >/dev/null ||
@@ -232,7 +233,7 @@ main() {
     start_app
     refused || fail "the new discriminator container let the banned client through"
     wait_for "discriminator logged no request refused under the ban" \
-        logged "$DISCRIMINATOR" '"action":"banned"'
+        logged "$DISCRIMINATOR" '"action":"temporarily_banned"'
     echo "example-app: a new discriminator container on the same volume keeps the ban"
 
     docker rm --force "$DISCRIMINATOR" >/dev/null