Rename the program to sww and its deciding daemon to discriminator (closes #218)

The program is now sww, built from cmd/sww, with two modes: sww rproxy and
sww discriminator. servewaf becomes discriminator everywhere it names that
daemon: the package (internal/discriminator), its types, functions, files, the
discriminator_line log field, and its docs and tests.

smallwebwaf is left only where sneak's directive allows it: the documents'
product name, the git.eeqj.de/sneak/smallwebwaf URLs, and the Go module path
sneak.berlin/go/smallwebwaf. Everywhere else a name containing it takes the sww
form: the package (internal/sww), metric names (sww_*), the X-Sww-* headers,
the /_sww/ admin endpoints, the OS user, and the state and rules directories.
The SWWAF_ environment variables take the SWW_ form.

No logic changes. make check passes.

Model: deepseek-v4-pro

Dockerfile

@@ -136,26 +136,10 @@ RUN mkdir /etc/sysusers.d \
 # ca-certificates, nix-bin and runit, from Ubuntu's archive. apt fetches
 # them over plain HTTP and checks each one against the archive's signed
 # package lists, so no CA certificates are needed.
-#
-# The image's dpkg config drops man pages as each package unpacks, so
-# xz-utils' install, which nix-bin depends on, prints an update-alternatives
-# warning for every man-page link it cannot make. This side file re-includes
-# them for this install alone; it is read after /etc/dpkg/dpkg.cfg.d/excludes,
-# so it overrides the drop and the links are made quietly. The cleanup below
-# removes the man pages and the links and directories they added, then puts
-# the base image's empty man directories back. The image holds exactly what
-# it held before, and installs built from it still drop man pages.
-RUN find /usr/share/man -mindepth 1 -type d > /tmp/base-man-dirs \
-    && echo 'path-include=/usr/share/man/*' > /etc/dpkg/dpkg.cfg.d/z-man \
-    && apt-get update \
+RUN apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get install --yes --no-install-recommends \
         ca-certificates nix-bin runit \
-    && rm -rf /var/lib/apt/lists/* /etc/dpkg/dpkg.cfg.d/z-man \
-    && find /usr/share/man ! -type d -delete \
-    && find /etc/alternatives -type l -xtype l -delete \
-    && find /usr/share/man -mindepth 1 -type d -empty -delete \
-    && xargs -a /tmp/base-man-dirs mkdir -p \
-    && rm /tmp/base-man-dirs
+    && rm -rf /var/lib/apt/lists/*
 
 # Nix run by root expects a group of build users, which nix-bin does not
 # create; with the setting empty, root's builds run without them.