Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

docs/metrics.md

@@ -1,8 +1,8 @@
 # The metrics
 
-What `GET /_sww/metrics` answers with, at `discriminator`'s own address.
-"Metrics endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus
-keeps the `instance` label as `exported_instance` unless the scrape sets
+What `GET /_sww/metrics` answers with, at `waf`'s own address. "Metrics
+endpoint" in [`SPEC.md`](../SPEC.md) describes the endpoint. Prometheus keeps
+the `instance` label as `exported_instance` unless the scrape sets
 `honor_labels: true`. `rproxy` has no metrics.
 
 Every `sww_*request_bytes_total` and `sww_*response_bytes_total` series counts
@@ -15,7 +15,7 @@ body bytes, never headers, whatever `SWW_BYTES_COUNT` says.
 - `sww_request_duration_seconds` and `sww_upstream_duration_seconds`, as
   histograms;
 - `sww_requests_in_flight`: the questions and requests to its own endpoints that
-  `discriminator` is handling.
+  `waf` is handling.
 
 ## Limits and bans
 
@@ -78,8 +78,8 @@ By `file`:
 
 ## When a request is counted
 
-`discriminator` counts a denied request at its decision, and a request to its
-own endpoints when it is answered. It counts an allowed request when its report
+`waf` counts a denied request at its decision, and a request to its own
+endpoints when it is answered. It counts an allowed request when its report
 comes, with the status, bytes and times the report gives. These are not counted:
 
 - a report itself;