Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

cmd/sww/main.go

@@ -1,6 +1,6 @@
 // Command sww is a web application firewall. `sww rproxy` is the reverse
-// proxy in front of one app, which asks discriminator about each request.
-// `sww discriminator` decides, for many sites, and keeps what lasts. `sww
+// proxy in front of one app, which asks waf about each request.
+// `sww waf` decides, for many sites, and keeps what lasts. `sww
 // healthcheck` is the container's health check. Everything it does is in
 // internal/sww.
 package main