README and SPEC name every offence that has a client checked (closes #151)

The AbuseIPDB section of README.md listed only a broken rate limit or
byte limit, a ban rule match, and a refusal by a block rule or the Core
Rule Set. A client is checked once its history counts any offence, so it
now also names the error burst, a request for a trap path and a refusal
for a missing or wrong token, as "What it does so far" does. The
definition of an offence under "Bans" in SPEC.md now names a refusal for
a missing or wrong token too, as the code counts one.

Model: opus-5-5

README.md

@@ -2160,13 +2160,14 @@ addresses sends, so that one client costs at most one check every
 `SWWAF_REPUTATION_CACHE_TTL`.
 
 Only a client whose history counts an offence is checked, so that the checks are
-spent on suspects: so far, one that has broken a rate limit or a byte limit,
+spent on suspects: so far, one that has broken a rate limit, a byte limit or the
-matched a ban rule, or had a request refused by a block rule or the Core Rule
+error burst, matched a ban rule, asked for a trap path, or had a request refused
-Set. A client dropped from the table of clients loses its history, and with it
+by a block rule, by the Core Rule Set or for a missing or wrong token. A client
-its offences. A client is checked in the background, at its first request after
+dropped from the table of clients loses its history, and with it its offences. A
-its offence that reaches the check: no request waits, a request refused under
+client is checked in the background, at its first request after its offence that
-its ban is not checked, and the request that has it checked, and any other from
+reaches the check: no request waits, a request refused under its ban is not
-it before the answer comes, goes on as from a client without a score.
+checked, and the request that has it checked, and any other from it before the
+answer comes, goes on as from a client without a score.
 
 A score at or over `SWWAF_ABUSEIPDB_MIN_SCORE`, 75 by default, is a hit, and
 `SWWAF_REPUTATION_ACTION` says what is done with its client, as for a DNSBL

SPEC.md

@@ -225,9 +225,9 @@ address or one /64, so a permanent ban does not reach neighbours who did
 nothing.
 
 An offence is a request `smallwebwaf` holds against the client: one that carries
-a clear sign of attack, breaks a limit, or is refused by a rule file or the Core
+a clear sign of attack, breaks a limit, or is refused by a rule file, by the
-Rule Set. Offences are counted by kind in the client's history. Two kinds lead
+Core Rule Set or for a missing or wrong token. Offences are counted by kind in
-to a ban, each by its own rule:
+the client's history. Two kinds lead to a ban, each by its own rule:
 
 - A clear sign of attack: a request that matches a rule file rule whose action
   is `ban`, or asks for a path in `SWWAF_TRAP_PATHS`. Examples are a probe for a