Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

docs/image.md

@@ -1,9 +1,9 @@
 # What the image holds
 
 The contents of the `smallwebwaf` image, and how each part is pinned. The image
-runs `rproxy` by default, or `discriminator` with `SWW_COMMAND=discriminator`.
-"Deployment" in [`SPEC.md`](../SPEC.md) says why each part is there and why it
-is pinned that way.
+runs `rproxy` by default, or `waf` with `SWW_COMMAND=waf`. "Deployment" in
+[`SPEC.md`](../SPEC.md) says why each part is there and why it is pinned that
+way.
 
 ## Contents
 
@@ -18,8 +18,8 @@ is pinned that way.
 - The `sww` binary, and the user `sww` (uid and gid 65532).
 - The service directory `/etc/service/sww`, with the `run` script
   `share/sww.run`.
-- `/var/lib/sww` for `discriminator`'s state files, and `/etc/sww/rules.d` with
-  the default rule file `share/rules.d/00-default.rules`.
+- `/var/lib/sww` for `waf`'s state files, and `/etc/sww/rules.d` with the
+  default rule file `share/rules.d/00-default.rules`.
 - `EXPOSE 8080`, and the `HEALTHCHECK` that runs `sww healthcheck`.
 
 ## Pins