flow/output: log triggered exception policies - v2

[jufajardini]

Changes (if applicable):

• I have updated the User Guide (in doc/userguide/) to reflect the changes made
• I have updated the JSON schema (in etc/schema.json) to reflect all logging changes (including schema descriptions)

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/6215

Previous PR: #12683

Output sample:

"flow": {
    "pkts_toserver": 4,
    "pkts_toclient": 5,
    "bytes_toserver": 495,
    "bytes_toclient": 351,
    "start": "2016-07-13T22:42:07.199672+0000",
    "end": "2016-07-13T22:42:07.573174+0000",
    "age": 0,
    "state": "new",
    "reason": "shutdown",
    "alerted": false,
    "action": "pass",
    "exception_policy_triggered": [
      {
        "target": "stream_midstream",
        "policy": "pass_flow"
      }
    ]
  },

Describe changes:

• change approach for logging exception policies to the flow event, now allowing for more than one triggered policy to be logged for the same flow
  -- this includes some implementation changes to accommodate that
• incorporate feedback from previous PR
  -- this includes an attempt at rearranging the Flow struct -- used pahole to check for holes and struct size. Size remains the same as before the change, from what I could compare

Provide values to any of the below to override the defaults.

SV_BRANCH=OISF/suricata-verify#2329

[jufajardini]

I'm not sure if the flow rearrangement will make sense for other architectures. I apologize in advance if I messed up things. Iirc, there's a less intrusive alternative that keeps the new field by the end and might also keep the same struct size as before, only with one 3 bytes hole in the last cacheline

[jufajardini]

Force-pushed to fix clang-format issue, forgot to re-run the script after rearranging the struct.

[suricata-qa]

ERROR:
ERROR: SEGMENTATION FAULT in build_asan QA test

ERROR: QA failed on build_asan.

Pipeline 24944