detect: add checks for multi-buffer keywords

tests/detect-email-received-multi/README.md

@@ -0,0 +1,11 @@
+# Test Description
+
+Test mime email.received keyword with multi-buffer features
+
+## PCAP
+
+reused
+
+## Redmine Ticket
+
+https://redmine.openinfosecfoundation.org/issues/5044

tests/detect-email-received-multi/suricata.yaml

@@ -0,0 +1,12 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filename: eve.json
+      types:
+        - smtp:
+            custom: [received]    # for 'received' logging information
+        - alert:
+            smtp: yes     # enable dumping of smtp fields

tests/detect-email-received-multi/test.rules

@@ -0,0 +1,8 @@
+# Match
+alert smtp any any -> any any (msg:"Test mime email received"; email.received: all; content:"from"; sid: 30;)
+alert smtp any any -> any any (msg:"Test mime email received"; email.received: all_or_absent; content:"from"; sid: 31;)
+alert smtp any any -> any any (msg:"Test mime email received"; email.received: matches 2; content:"relay1"; sid: 32;)
+alert smtp any any -> any any (msg:"Test mime email received"; email.received: index 1; content:"relay1"; sid: 33;)
+alert smtp any any -> any any (msg:"Test mime email received"; email.received: any_or_absent; content:!"notseen"; sid: 34;)
+
+alert smtp any any -> any any (msg:"Test mime email received"; email.received: all; to_lowercase; content:"from"; sid: 40;)

tests/detect-email-received-multi/test.yaml

@@ -0,0 +1,51 @@
+requires:
+  min-version: 9
+
+args:
+  - -k none --set stream.inline=true
+
+pcap: ../detect-email-received/input.pcap
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: smtp
+      email.received[0]: "from client.local (client.local [10.0.0.1]) by smtp.relay1.com with ESMTP id relay1abc; Thu, 10 Apr 2025 12:00:00 -0000"
+      email.received[1]: "from smtp.relay1.com (smtp.relay1.com [10.0.0.10]) by smtp.relay2.com with ESMTP id relay2xyz; Thu, 10 Apr 2025 12:01:00 -0000"
+      email.received[2]: "from smtp.relay2.com (smtp.relay2.com [10.0.0.20]) by smtp.destination.com with ESMTP id final123; Thu, 10 Apr 2025 12:02:00 -0000"
+- filter:
+    count: 1
+    match:
+      event_type: smtp
+      email.received.__len: 3
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 30
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 31
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 32
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 33
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 34
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 40