Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

internal/sww/healthcheck_test.go

@@ -19,11 +19,11 @@ const (
 	// commandSetting says which command a container runs, and which the health
 	// check checks.
 	commandSetting = "SWW_COMMAND"
-	// discriminatorCommand is the command that runs discriminator.
-	discriminatorCommand = "discriminator"
+	// wafCommand is the command that runs waf.
+	wafCommand = "waf"
 )
 
-func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
+func TestHealthCheckInWAFsContainer(t *testing.T) {
 	t.Parallel()
 
 	ctx, stop := context.WithCancel(t.Context())
@@ -47,7 +47,7 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 	// The container's settings: an address to listen on with an empty
 	// host part, which the health check asks at 127.0.0.1.
 	wantHealthCheck(t, map[string]string{
-		commandSetting: discriminatorCommand, listenAddr: ":" + port,
+		commandSetting: wafCommand, listenAddr: ":" + port,
 	}, 0, "")
 
 	// The health check reads that setting alone, here given as a file: a removed
@@ -59,7 +59,7 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 		{"SWW_MODE", "neither"},
 	} {
 		wantHealthCheck(t, map[string]string{
-			commandSetting:       discriminatorCommand,
+			commandSetting:       wafCommand,
 			listenAddr + "_FILE": writeFile(t, ":"+port+"\n"),
 			other.name:           other.value,
 		}, 0, "")
@@ -68,10 +68,10 @@ func TestHealthCheckInDiscriminatorsContainer(t *testing.T) {
 	// Listening on port 0 takes any free port, so nothing listens on port 0
 	// itself.
 	wantHealthCheck(t, map[string]string{
-		commandSetting: discriminatorCommand, listenAddr: ":0",
-	}, 1, "unhealthy: ask discriminator: ")
+		commandSetting: wafCommand, listenAddr: ":0",
+	}, 1, "unhealthy: ask waf: ")
 	wantHealthCheck(t, map[string]string{
-		commandSetting: discriminatorCommand, listenAddr: "8080",
+		commandSetting: wafCommand, listenAddr: "8080",
 	}, 1, "unhealthy: invalid setting: SWW_LISTEN_ADDR: ")
 
 	stop()
@@ -90,7 +90,7 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	defer app.Close()
 
 	// Nothing listens at the backend. The health check asks rproxy and the app,
-	// whether or not discriminator answers.
+	// whether or not waf answers.
 	site, _ := startRProxy(t, "http://127.0.0.1:9", app.URL)
 	_, port, _ := net.SplitHostPort(strings.TrimPrefix(site, "http://"))
 	settings := func(more ...string) map[string]string {
@@ -107,7 +107,7 @@ func TestHealthCheckInRProxysContainer(t *testing.T) {
 	wantHealthCheck(t, settings(commandSetting, "rproxy"), 0, "")
 
 	// SWW_COMMAND cannot be given as a file.
-	wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "discriminator\n")),
+	wantHealthCheck(t, settings(commandSetting+"_FILE", writeFile(t, "waf\n")),
 		0, "")
 
 	// Another setting does not fail it, even an invalid one, and neither does
@@ -137,7 +137,7 @@ func TestHealthCheckFailsWithAnyOtherCommand(t *testing.T) {
 
 	wantHealthCheck(t, map[string]string{commandSetting: "healthcheck"}, 1,
 		"unhealthy: invalid setting: SWW_COMMAND: "+
-			"\"healthcheck\" is not rproxy or discriminator\n")
+			"\"healthcheck\" is not rproxy or waf\n")
 }
 
 func TestHealthCheckRefusesAnArgument(t *testing.T) {