Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the SWW_COMMAND setting, the OS user, and the state
and rules directories.

No logic changes. make check passes.

Model: deepseek-v4-pro

internal/waf/waf.go

@@ -1,10 +1,10 @@
 // Package waf runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWWAF_WAF_BODY_LIMIT is set, with the six changes smallwebwaf
+// body while SWWAF_WAF_BODY_LIMIT is set, with the six changes sww
 // makes to it, as "Attack detection" under "Settings" in SPEC.md describes
 // them. It reads no response.
 //
-// smallwebwaf writes only to its state directory, so Coraza is built with
+// sww writes only to its state directory, so Coraza is built with
 // its no_fs_access tag, as the Dockerfile and script/build build it: of a
 // file in a multipart body, Coraza then counts the bytes instead of
 // writing them to the system's temporary directory.
@@ -25,15 +25,15 @@ import (
 	"github.com/corazawaf/coraza/v3/types"
 )
 
-// directives are the Core Rule Set as smallwebwaf runs it, with the
+// directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, and bodyDirectives for %s while
-// SWWAF_WAF_BODY_LIMIT is set. Each rule smallwebwaf adds has an id from
+// SWWAF_WAF_BODY_LIMIT is set. Each rule sww adds has an id from
 // 900000 to 900999, the ids the Core Rule Set keeps for the rules that set
 // it up, which SWWAF_WAF_DISABLED_RULES refuses, so that no setting
 // switches one off. Coraza joins a line ending in \ to the next, without
 // the spaces at the start of the next.
 const directives = `
-# The engine only detects. smallwebwaf compares the request's anomaly
+# The engine only detects. sww compares the request's anomaly
 # score with SWWAF_WAF_ANOMALY_THRESHOLD itself, in block and detect mode
 # alike. It reads no body, unless bodyDirectives switch that on.
 SecRuleEngine DetectionOnly