Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

internal/config/config.go

@@ -1,6 +1,6 @@
 // Package config reads sww's settings, and is the one place they are
 // read. Every setting is an environment variable. The settings of `sww
-// discriminator` start with SWW_, every one of them has a default, and most can be
+// waf` start with SWW_, every one of them has a default, and most can be
 // given as a file instead. Those of `sww rproxy` start with SWRP_. Each
 // of them but SWRP_WAF_BACKEND has a default, and none can be given as a file,
 // since rproxy never touches disk. SWW_COMMAND chooses which of the two
@@ -32,10 +32,10 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
 )
 
-// Config is the settings of `sww discriminator`. A time or size limit of
+// Config is the settings of `sww waf`. A time or size limit of
 // zero is off.
 type Config struct {
-	// ListenAddr is where discriminator listens (SWW_LISTEN_ADDR).
+	// ListenAddr is where waf listens (SWW_LISTEN_ADDR).
 	ListenAddr string
 	// InstanceName is the name every log line and alert gives as instance,
 	// and every metric carries as its label instance (SWW_INSTANCE_NAME),
@@ -239,7 +239,7 @@ type Config struct {
 	// attack (SWW_TRAP_PATHS), each starting with / and without a ?.
 	TrapPaths []string
 	// ErrorBurstThreshold is the most requests of a client within a minute
-	// that discriminator may refuse after a rule file or Core Rule Set match; one
+	// that waf may refuse after a rule file or Core Rule Set match; one
 	// more breaks a limit (SWW_ERROR_BURST_THRESHOLD). 0 is off.
 	ErrorBurstThreshold int64
 	// LogRemoteURL is where every line on stdout is also sent
@@ -378,8 +378,8 @@ var (
 	errNeedsDBPath     = errors.New("it names the file to look clients up in")
 	errDBPathUnused    = errors.New("only file reads it")
 	errOver64K         = errors.New(
-		"is more than 64K, the most discriminator gets of a body")
-	errNotCommand           = errors.New("is not rproxy or discriminator")
+		"is more than 64K, the most waf gets of a body")
+	errNotCommand           = errors.New("is not rproxy or waf")
 	errNotDurationAboveZero = errors.New(
 		"is not a duration above zero, such as 1h or 7d")
 	errNotNumberAboveZero = errors.New(
@@ -627,7 +627,7 @@ func FromEnvironment(
 }
 
 // Command reads only SWW_COMMAND, the command the image runs and its
-// health check checks: rproxy when it is unset or empty, or discriminator. It cannot
+// health check checks: rproxy when it is unset or empty, or waf. It cannot
 // be given as a file. Any other value is an error that names the setting.
 func Command(lookupEnv func(string) (string, bool)) (string, error) {
 	command, _ := lookupEnv("SWW_COMMAND")
@@ -635,17 +635,17 @@ func Command(lookupEnv func(string) (string, bool)) (string, error) {
 	switch command {
 	case "", "rproxy":
 		return "rproxy", nil
-	case "discriminator":
+	case "waf":
 		return command, nil
 	default:
 		return "", fmt.Errorf("SWW_COMMAND: %q %w", command, errNotCommand)
 	}
 }
 
-// DiscriminatorListenAddr reads only SWW_LISTEN_ADDR, which may be given as a
-// file, as FromEnvironment does. The health check in discriminator's container needs
+// WAFListenAddr reads only SWW_LISTEN_ADDR, which may be given as a
+// file, as FromEnvironment does. The health check in waf's container needs
 // no other setting, so it reads no other, nor a file that another names.
-func DiscriminatorListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
+func WAFListenAddr(lookupEnv func(string) (string, bool)) (string, error) {
 	env := &environment{lookupEnv: lookupEnv}
 	listenAddr := env.address("SWW_LISTEN_ADDR")
 
@@ -1610,7 +1610,7 @@ func parseSize(value string) (int64, error) {
 }
 
 // parseWAFBodyLimit reads the most of a request body the Core Rule Set
-// reads: a size as parseSize reads it, or off, but at most 64K, since discriminator
+// reads: a size as parseSize reads it, or off, but at most 64K, since waf
 // gets no more of a body than that.
 func parseWAFBodyLimit(value string) (int64, error) {
 	limit, err := parseSize(value)
@@ -1955,7 +1955,7 @@ func ParseASN(value string) (string, error) {
 	return "AS" + strconv.FormatUint(number, 10), nil
 }
 
-// The tags a request can get that the settings can name, as discriminator
+// The tags a request can get that the settings can name, as waf
 // writes them. The prefixes are followed by a value.
 const (
 	ASNTagPrefix     = "asn="