Detect count 5044 v4.6

[catenacyber]

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/5044

Describe changes:

• adds other modes to multi-buffers like all, all_or_absent, matches`, and precise indexing

SV_BRANCH=OISF/suricata-verify#3062

Draft : I would like some approval before doing all the individual modifications for each multi-buffer

#16097 after AI review

TODOs :

• add support for all multi-buf keywords
• add count support

[codecov]

Codecov Report

❌ Patch coverage is 78.72340% with 50 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.03%. Comparing base (acd9d3a) to head (ec3e1e3).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #16100      +/-   ##
==========================================
- Coverage   83.05%   83.03%   -0.03%     
==========================================
  Files        1004     1005       +1     
  Lines      277359   277563     +204     
==========================================
+ Hits       230370   230476     +106     
- Misses      46989    47087      +98     

Flag	Coverage Δ
fuzzcorpus	61.45% <27.43%> (-0.08%)	⬇️
livemode	18.41% <7.52%> (-0.19%)	⬇️
netns	22.85% <7.52%> (-0.06%)	⬇️
pcap	45.29% <12.83%> (-0.12%)	⬇️
suricata-verify	67.13% <76.99%> (-0.02%)	⬇️
unittests	58.50% <23.82%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[catenacyber]

Medium — src/detect-multi.c:58: Selector markers are appended before transformations are resolved. A rule such as email.received: all; to_lowercase; content:"from"; leaves the marker alone on the original buffer and is rejected during validation. Preserve the selector on the transformed buffer and add selector-plus-transform coverage.

I guess I should test this case

[suricata-qa]

Information:

ERROR: QA failed on IPS_AFP_drop_chk.

field	baseline	test	%
	IPS_AFP_stats_chk
.ips.blocked	706320	847552	120.0%
.ips.drop_reason.exception_policy_flow_drop	0	132934	-
.ips.drop_reason.applayer_error	0	1177	-
.ips.drop_reason.stream_error	0	7245	-
.ips.drop_reason.stream_midstream	0	189	-
.capture.kernel_drops	0	87372	-
.tcp.ack_unseen_data	162000	169550	104.66%
.tcp.reassembly_gap	54000	59986	111.09%
.tcp.overlap	0	12	-
.flow.end.state.new	5400	5999	111.09%
.flow.end.tcp_state.syn_sent	0	268	-
.flow.end.tcp_state.fin_wait1	0	53	-
.flow.end.tcp_state.fin_wait2	0	31	-
.flow.end.tcp_state.time_wait	0	20	-
.flow.end.tcp_state.last_ack	0	43	-
.flow.end.tcp_state.close_wait	0	85	-
.flow.end.tcp_liberal	54000	55728	103.2%
.exception_policy.tcp.midstream.drop_flow	0	189	-
.exception_policy.app_layer.error.drop_flow	0	1180	-
.app_layer.error.http.parser	0	17	-
.app_layer.error.ftp.gap	0	3	-
.app_layer.error.smtp.gap	0	53	-
.app_layer.error.tls.gap	0	1067	-
.app_layer.error.ssh.gap	0	1	-
.app_layer.error.dcerpc_tcp.parser	0	34	-
.app_layer.error.pop3.parser	0	5	-

Pipeline = 33278

[catenacyber]

Replaced by #16103