Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

docs/alerts.md

@@ -6,7 +6,7 @@ back or dropped.
 
 ## Events
 
-- `ban`: a ban `discriminator` made.
+- `ban`: a ban `waf` made.
 - `permanent_ban`: a permanent ban it made, or an existing ban made permanent by
   a request.
 - `core_rule_set_match`: the Core Rule Set scored a request at or over the
@@ -34,7 +34,7 @@ on one line:
 
 ```json
 {
-    "instance": "fsn1/discriminator",
+    "instance": "fsn1/waf",
     "time": "2026-10-06T12:00:50.123461Z",
     "event": "ban",
     "host": "app.example",
@@ -79,9 +79,8 @@ on one line:
 
 - `instance`: `SWW_INSTANCE_NAME`. `time`: when the alert was raised. `event`:
   one of the events above.
-- `host`: the site of the request that raised the alert, since one
-  `discriminator` serves many sites. It is left out of `source_failure`,
-  `file_error` and `summary`.
+- `host`: the site of the request that raised the alert, since one `waf` serves
+  many sites. It is left out of `source_failure`, `file_error` and `summary`.
 - `client`: the address whose request raised the alert. Empty for
   `source_failure`, `file_error` and `summary`.
 - `netblock`: empty for `source_failure`, `file_error` and `summary`; otherwise
@@ -111,8 +110,8 @@ on one line:
 ## Slack and ntfy
 
 Slack and ntfy get a message with a title and a text. The title is the instance
-and the event, such as `fsn1/discriminator: ban`. The text is the `reason`, then
-one line for each of these that the alert has:
+and the event, such as `fsn1/waf: ban`. The text is the `reason`, then one line
+for each of these that the alert has:
 
 - the host, the client, the netblock and the country;
 - the file, the source, the error and the mode from `detail`;