Rename the program to sww and its deciding daemon to discriminator

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the SWW_COMMAND setting, the OS user, and the state
and rules directories.

No logic changes. make check passes.

Model: deepseek-v4-pro

script/build

@@ -1,5 +1,5 @@
 #!/bin/sh
-# script/build: build bin/smallwebwaf on the host, with Go installed, for
+# script/build: build bin/sww on the host, with Go installed, for
 # working on the code by hand. The version it reports comes from git, as
 # in script/docker, and the no_fs_access tag is the Dockerfile's.
 set -eu
@@ -12,7 +12,7 @@ main() {
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     go build -tags no_fs_access -trimpath -ldflags "-X main.Version=$version" \
-        -o bin/smallwebwaf ./cmd/smallwebwaf
+        -o bin/sww ./cmd/sww
 }
 
 main "$@"