Dns over http2 5773 v6

[catenacyber]

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/5773

Describe changes:

• analyze DNS over HTTP2

SV_BRANCH=pr/1573

OISF/suricata-verify#1573

Draft to get feedback about approach...
Leaving comments on the code for specific questions

#10125 rebased on top of #10166 (and thus getting rid of output-json-doh2.c)

TODO :

• Fix dns json schema and logging first (that is https://redmine.openinfosecfoundation.org/issues/6281 )
• Use config for dns logging...

Functionnaly, in terms of output :

• The flow will have doh2 as app_proto (and http2 as app_proto_orig)
• There are doh2 events that have both http2 and dns fields. dns logging is done like alerts, not like dns events...
• DNS and HTTP and HTTP2 signatures work on DOH2
• Signatures can be DOH2 specific. These signatures can combine http, http2 and dns keywords.
• DNS Frames do not work on DoH2

Memory management

• a HTTP2 tx can own 2 DNS tx (one to client, one to server)
• a HTTP2 tx stores the streamed DNS response content until it is complete before parsing it (limiting to U16_MAX bytes)

API

• There is a new DOH2 app-layer protocol which resorts to HTTP2 for most of the things
• HTTP2 parsing discovering DOH2 changes the app_proto to DOH2, doh2 can be enabled or disabled in suricata.yaml config
• There are more alproto "comparison" functions
• Every DNS keyword needs to check the flow alproto to change the transaction
• Every DNS/HTTP keyword is automatically registered for DOH2 (hacking DetectAppLayerMpmRegister2...)

[catenacyber]

CI is red/SV is failing because OISF/suricata-verify#1490 is missing in OISF/suricata-verify#1573

[suricata-qa]

Information:

ERROR: QA failed on SURI_TLPW2_autofp_suri_time.

field	baseline	test	%
	SURI_TLPW2_autofp_stats_chk
.uptime	181	192	106.08%

Pipeline 17557

[catenacyber]

Rebased in #10733