Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

script/run

@@ -1,9 +1,9 @@
 #!/bin/sh
-# script/run: build bin/sww with script/build and run discriminator and
+# script/run: build bin/sww with script/build and run waf and
 # rproxy on the host, with the settings in the environment, until rproxy
 # exits or the script is told to stop. rproxy listens on port 8080 unless
 # SWRP_LISTEN_ADDR says otherwise, in front of the app at SWRP_UPSTREAM_URL.
-# discriminator listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and
+# waf listens on port 8090 unless SWW_LISTEN_ADDR says otherwise, and
 # rproxy asks it there unless SWRP_WAF_BACKEND says otherwise. Unless
 # SWW_STATE_DIR is set, the state files go in bin/state, beside the binary,
 # and unless SWW_RULES_DIR is set, the rule files are those of share/rules.d,
@@ -13,14 +13,14 @@ set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
-DISCRIMINATOR=""
+WAF=""
 RPROXY=""
 
-# stop_both: stop what runs, and wait for it, so that discriminator writes its state
+# stop_both: stop what runs, and wait for it, so that waf writes its state
 # files.
 stop_both() {
     trap '' HUP INT TERM
-    kill $DISCRIMINATOR $RPROXY 2>/dev/null || true
+    kill $WAF $RPROXY 2>/dev/null || true
     wait || true
 }
 
@@ -42,8 +42,8 @@ main() {
     trap stop_both EXIT
     trap 'exit 1' HUP INT TERM
 
-    "$ROOT/bin/sww" discriminator &
-    DISCRIMINATOR=$!
+    "$ROOT/bin/sww" waf &
+    WAF=$!
     "$ROOT/bin/sww" rproxy &
     RPROXY=$!
     wait "$RPROXY"