Name request log actions so they say what they mean (closes #229)

Rename too_large, rate_limited, rule_blocked and denied, and split banned
into temporarily_banned and permanently_banned by whether the ban runs out.
A client under both a temporary and a permanent ban gets the permanent one.
A request that makes a ban permanent gets permanently_banned. A ban rule, a
trap path or a CrowdSec decision gets the value for the ban it makes, and in
observe mode would_action names the ban enforce mode would have made.

The offence kind rule_blocked follows, as a metric label and a key in
clients.json.

Model: opus-5-5

docs/request-log.md

@@ -96,13 +96,15 @@ Every one of these lines has:
 
 - `action`: what was done:
     - `forward`: answered `allow`, so that `rproxy` passes it to the app;
-    - `denied`: refused for `SWW_DENY_NETS`, for a reputation source with the
-      action `deny`, or for a tag in `SWW_TAG_DENY`;
-    - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
-      CrowdSec decision, each of which bans the client;
-    - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
-      refused by that check;
-    - `too_large`: over a header limit;
+    - `client_denied`: refused for `SWW_DENY_NETS`, for a reputation source with
+      the action `deny`, or for a tag in `SWW_TAG_DENY`;
+    - `temporarily_banned`: refused under a ban that runs out, or for a `ban`
+      rule, a trap path or a CrowdSec decision that made such a ban;
+    - `permanently_banned`: refused under a ban that never runs out, including a
+      ban this request made or made permanent;
+    - `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
+      `waf_blocked`: refused by that check;
+    - `request_header_too_large`: over a header limit;
     - `admin`: answered at one of `discriminator`'s own endpoints, or `404` for
       a path under `/_sww/`.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a

docs/state-files.md

@@ -63,8 +63,9 @@ since it was first seen:
 - total requests, and how many were forwarded and how many refused;
 - body bytes of its requests, and of the responses it was sent;
 - responses by status class;
-- offences by kind: `limit`, `attack`, `rule_blocked` and `waf_blocked`. A file
-  may also hold `token_refused`, which is kept, and which nothing adds to.
+- offences by kind: `limit`, `attack`, `blocked_by_block_rule` and
+  `waf_blocked`. A file may also hold `token_refused`, which is kept, and which
+  nothing adds to.
 
 ## `lookups.json`