Suricata

This change attempts PCRE_NO_AUTO_CAPTURE on all unnamed capture groups, as if ?: had been specified for all groups, reverting to ordinary capturing behavior if needed (if, for example, \1 is referenced).

The result is more efficient, unchanged PCRE signatures in the common case.

Rationale
---------
Remembering capture groups takes memory and time. Most signature writers don't think of using ?: when writing signatures to request more efficient behavior.

Many, many pcre: instructions in common signatures specify /(what|ever)+/ when the more efficient /(?:what|ever)+/ is all that is needed. Of the approximately 6100 ET sigs with parentheses in pcre: specifiers, only 150 reference unnamed captures and zero use ?: to disable saving captures.

In my admittedly limited testing, the 15-digit CC signatures profiled about 6% faster when compiled with PCRE_NO_AUTO_CAPTURE or when rewritten to make use of ?:.

Notes
-----
This change has no effect on named capture groups nor, as mentioned, signatures with reference earlier captures via \1, \2, etc.