Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

docs/request-log.md

@@ -1,32 +1,32 @@
 # The request log's fields
 
-The fields of the JSON objects `rproxy` and `discriminator` write about each
-request. "Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line
-is written and how the log is sent to a syslog server. A field that does not
-apply to a request is left out.
+The fields of the JSON objects `rproxy` and `waf` write about each request.
+"Request log" and "The log" in [`SPEC.md`](../SPEC.md) say when a line is
+written and how the log is sent to a syslog server. A field that does not apply
+to a request is left out.
 
-## `discriminator`'s lines
+## `waf`'s lines
 
-`sww discriminator` writes two lines for each question it answers, joined by
-`request_id`. The field `discriminator_line` says which of the two a line is:
+`sww waf` writes two lines for each question it answers, joined by `request_id`.
+The field `waf_line` says which of the two a line is:
 
 - `decision`: the line it writes once it has answered the question;
 - `report`: the line it writes when `rproxy`'s report comes, with everything
   known. The repetition is intended.
 
-A request to its own endpoints writes one line, without `discriminator_line`. A
-report writes no line but the `report` line of the request it names.
+A request to its own endpoints writes one line, without `waf_line`. A report
+writes no line but the `report` line of the request it names.
 
 These questions write no line:
 
-- a question refused with `400` (see "The question" under "`discriminator`" in
+- a question refused with `400` (see "The question" under "`waf`" in
   [`SPEC.md`](../SPEC.md));
 - a question whose body stopped arriving, which gets no answer.
 
 A `report` line:
 
 ```
-{"type":"request","discriminator_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/discriminator","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"core_rule_set_score":0,"duration_total_ms":3.217,"duration_checks_ms":0.041,"duration_core_rule_set_ms":0.029,"duration_upstream_total_ms":3.104}
+{"type":"request","waf_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/waf","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"core_rule_set_score":0,"duration_total_ms":3.217,"duration_checks_ms":0.041,"duration_core_rule_set_ms":0.029,"duration_upstream_total_ms":3.104}
 ```
 
 ### Every line
@@ -41,9 +41,8 @@ Every one of these lines has:
 
 ### Standard web log fields
 
-- `time`: when `discriminator` had read the question's body, RFC 3339 with
-  milliseconds, in UTC. The `report` line gives the same time as the `decision`
-  line.
+- `time`: when `waf` had read the question's body, RFC 3339 with milliseconds,
+  in UTC. The `report` line gives the same time as the `decision` line.
 - `instance`: `SWW_INSTANCE_NAME`.
 - `client_ip`: the visitor's address, as `rproxy` worked it out.
 - `method`, `path` and `query`: the visitor's request.
@@ -52,9 +51,8 @@ Every one of these lines has:
 - `host`: the site the visitor asked for.
 - `protocol`: the question's own, `HTTP/1.1`.
 - `status`:
-    - on the `decision` line, what `discriminator` answered: `200` for `allow`,
-      the status of `deny`, or `0` for `close`, as the visitor is then sent
-      nothing;
+    - on the `decision` line, what `waf` answered: `200` for `allow`, the status
+      of `deny`, or `0` for `close`, as the visitor is then sent nothing;
     - on the `report` line, what the visitor got, `0` if nothing.
 - `request_bytes`:
     - on the `decision` line, how much of the question's body the Core Rule Set
@@ -62,7 +60,7 @@ Every one of these lines has:
     - on the `report` line, the bytes of the visitor's body that `rproxy` read,
       with what a WebSocket carried from the visitor.
 - `response_bytes`:
-    - on the `decision` line, the body of `discriminator`'s answer;
+    - on the `decision` line, the body of `waf`'s answer;
     - on the `report` line, the bytes of the answer's body, with what a
       WebSocket carried from the app.
 - `referer` and `user_agent`.
@@ -79,7 +77,7 @@ Every one of these lines has:
     - lookups are off;
     - the client is not looked up;
     - the source cannot place the client;
-    - GeoJS had not answered by the time `discriminator` answered.
+    - GeoJS had not answered by the time `waf` answered.
 - `content_type`: the visitor's `Content-Type`.
 - `content_length`: the body length the visitor announced.
 - `request_headers`: the headers listed in `SWW_LOG_REQUEST_HEADERS`, by name in
@@ -89,7 +87,7 @@ Every one of these lines has:
 
 ### Response detail
 
-- `response_content_type`: the type of `discriminator`'s own answer.
+- `response_content_type`: the type of `waf`'s own answer.
 - `aborted`: true when `rproxy` went away before the answer.
 
 ### Decision
@@ -105,8 +103,8 @@ Every one of these lines has:
     - `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
       `blocked_by_core_rule_set`: refused by that check;
     - `request_header_too_large`: over a header limit;
-    - `own_endpoint`: answered at one of `discriminator`'s own endpoints, or
-      `404` for a path under `/_sww/`.
+    - `own_endpoint`: answered at one of `waf`'s own endpoints, or `404` for a
+      path under `/_sww/`.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
   request it would have refused. `action` then names what was done, normally
   `forward`.
@@ -131,9 +129,8 @@ Every one of these lines has:
     - `core_rule_set`: `score`, and `threshold`, `SWW_WAF_ANOMALY_THRESHOLD`;
     - `refusal_limit`: `window`, `count` and `limit`, of the error burst;
     - `byte_limits`: `window`, `count` and `limit`, the count in bytes.
-- `after_answer_heuristic`: the heuristic that banned the client after
-  `discriminator` answered the request, in `observe` mode too: `refusal_limit`
-  or `byte_limits`.
+- `after_answer_heuristic`: the heuristic that banned the client after `waf`
+  answered the request, in `observe` mode too: `refusal_limit` or `byte_limits`.
 - `after_answer_heuristic_figures`: an object of the figures that heuristic
   acted on, as listed above.
 
@@ -191,8 +188,8 @@ Every one of these lines has:
 All in milliseconds:
 
 - `duration_total_ms`:
-    - on the `decision` line, from `discriminator` having read the question's
-      body to the line;
+    - on the `decision` line, from `waf` having read the question's body to the
+      line;
     - on the `report` line, from `rproxy` having read the request's headers to
       the end of the answer.
 - `duration_checks_ms`: to the end of the checks;
@@ -202,8 +199,8 @@ All in milliseconds:
 
 ### Requests to its own endpoints
 
-The line of a request to `discriminator`'s own endpoints has these fields, with
-these meanings where they differ:
+The line of a request to `waf`'s own endpoints has these fields, with these
+meanings where they differ:
 
 - `client_ip` and `peer_ip`: the request's TCP peer.
 - `request_id`: a new random one of 26 letters and digits.
@@ -216,7 +213,7 @@ these meanings where they differ:
 ## `rproxy`'s line
 
 `sww rproxy` writes one short line for each request. `request_id` joins it to
-`discriminator`'s two. It has these fields and no others:
+`waf`'s two. It has these fields and no others:
 
 - `type`: `request`.
 - `time`: when the request arrived, RFC 3339 with milliseconds, in UTC.
@@ -231,15 +228,15 @@ these meanings where they differ:
   carried from the app.
 - `duration_request_ms`: milliseconds from the request's headers being read
   until the app had been sent the whole request, or the answer started if that
-  was sooner. It includes the wait for `discriminator`.
+  was sooner. It includes the wait for `waf`.
 - `duration_response_ms`: milliseconds from then until the end of the answer.
 - `disposition`: what was done with the request: `allow`, `deny` or `close`. It
-  is `discriminator`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is
-  left out when:
-    - `discriminator` was not asked, as for the health check;
-    - the visitor went away while `discriminator` was being asked;
-    - `discriminator`'s answer had no valid `X-Sww-Disposition`;
-    - `rproxy` could not pass on `discriminator`'s answer, and answered `502`.
+  is `waf`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is left out
+  when:
+    - `waf` was not asked, as for the health check;
+    - the visitor went away while `waf` was being asked;
+    - `waf`'s answer had no valid `X-Sww-Disposition`;
+    - `rproxy` could not pass on `waf`'s answer, and answered `502`.
 - `default_disposition`: `true` when `SWRP_DEFAULT_DISPOSITION` gave
   `disposition`, and otherwise left out.