rule: Don't drop flow if rule matches on packet properties.

[jlucovsky]

This commit modifies the logic used to determine the disposition of a flow/packet.

If the rule contains packet match properties, the flow shouldn't be dropped.

Link to redmine ticket: 5578

Describe changes:

• When deciding how to handle the drop action, check if the rule applies to packet properties.

Provide values to any of the below to override the defaults.

To use a pull request use a branch name like pr/N where N is the
pull request number.

Alternatively, SV_BRANCH may also be a link to an
OISF/suricata-verify pull-request.

SV_BRANCH=OISF/suricata-verify#1414

[suricata-qa]

Information:

ERROR: QA failed on IPS_AFP_drop_chk.

field	baseline	test	%
	IPS_AFP_stats_chk
.tcp.reassembly_gap	54000	108000	200.0%
.flow_bypassed.local_pkts	0	25920	-
.flow_bypassed.local_bytes	0	2833920	-
.detect.alerts_suppressed	1058400	1112400	105.1%

Pipeline 15863

[suricata-qa]

Information:

ERROR: QA failed on IPS_AFP_drop_chk.

field	baseline	test	%
	IPS_AFP_stats_chk
.tcp.reassembly_gap	54000	108000	200.0%
.flow_bypassed.local_pkts	0	25920	-
.flow_bypassed.local_bytes	0	2833920	-
.detect.alerts_suppressed	1058400	1112400	105.1%

Pipeline 15874

[jufajardini]

I wish I could signal to watch this PR, to better understand this.
And this makes me wonder if we should try and document those flags....

[inashivb]

This patch makes sense to me.
I have added the s-v tests done by Victor to the PR body and re-triggered the CI.

[inashivb]

The s-v test seems to pass. The test http2-deflate on Ubuntu 22.04 is failing. The test seems flaky to me but would be nice if you checked.

[jlucovsky]

Continued in #9664