Rename discriminator to waf everywhere (closes #312)

The command is now `sww waf`, and the package is `internal/waf`. Types,
functions, files, tests, comments, docs, the Dockerfile, the runit
script, `script/`, compose examples, the log field `waf_line` and the
`X-From-Waf` test header follow. No behaviour changes, and no setting
changes name: rproxy already finds the waf through `SWRP_WAF_BACKEND`.

Done with one `sed -i` (Discriminator and DISCRIMINATOR to WAF,
discriminator to waf) over the files `git grep -i discriminator`
listed, as sneak allowed for this rename, then `git mv` for the
package and files. By hand afterwards: the header's spelling, which
the linter requires, and the padding after `waf` in `sww`'s usage
text.

Model: opus-5-5

share/sww.run

@@ -3,7 +3,7 @@ set -euo pipefail
 
 # runit's run script for sww, run again whenever sww
 # exits; the wait spaces out the restarts. SWW_COMMAND names the
-# command to run: rproxy when it is unset or empty, or discriminator. With any
+# command to run: rproxy when it is unset or empty, or waf. With any
 # other value the script starts nothing and stops with a message naming it.
 # exec, so that the signal `sv stop` sends reaches sww itself.
 main() {
@@ -11,9 +11,9 @@ main() {
     local command="${SWW_COMMAND:-rproxy}"
     case "$command" in
         rproxy) ;;
-        discriminator) give_state_dir_to_sww ;;
+        waf) give_state_dir_to_sww ;;
         *)
-            printf 'SWW_COMMAND: "%s" is not rproxy or discriminator\n' \
+            printf 'SWW_COMMAND: "%s" is not rproxy or waf\n' \
                 "$command" >&2
             exit 1
             ;;
@@ -25,9 +25,9 @@ main() {
 # it to the sww user, so that a volume mounted there needs no change
 # of owner; chown -R changes a symbolic link itself, never what it points
 # to. When SWW_STATE_DIR, in either form, cannot be read or is not the
-# absolute path of a directory, no owner is changed, and discriminator starts and
+# absolute path of a directory, no owner is changed, and waf starts and
 # stops with a message naming the setting. A change of owner that fails, as
-# on a volume mounted read-only, does not end the script either: discriminator
+# on a volume mounted read-only, does not end the script either: waf
 # reports a directory it cannot write.
 give_state_dir_to_sww() {
     local dir