Suricata

My last commit to make stream-events compatible to 'deonly' appears to have broken it.

Still I think my idea made sense: just like decoder-event rules we can safely check them separately from the normal rules and only if actual events are set.