Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

docs/rules.md

@@ -54,20 +54,18 @@ empty-agent      user_agent  log     ^$
 
 ## A file of your own
 
-`discriminator` reads the rule files in its own container. Rules of your own go
-in a file named to sort after the default, such as `50-site.rules`:
+`waf` reads the rule files in its own container. Rules of your own go in a file
+named to sort after the default, such as `50-site.rules`:
 
 ```
 # 50-site.rules: WordPress probes, which this site never serves
 wp-probe         path        ban     (?i)^/(wp-login\.php|xmlrpc\.php|wp-admin/)
 ```
 
-A `Dockerfile` built on the `smallwebwaf` image, for `discriminator` to run
-from, adds it:
+A `Dockerfile` built on the `smallwebwaf` image, for `waf` to run from, adds it:
 
 ```dockerfile
 COPY 50-site.rules /etc/sww/rules.d/50-site.rules
 ```
 
-Or mount it there. A `path` rule applies on every site behind that
-`discriminator`.
+Or mount it there. A `path` rule applies on every site behind that `waf`.