detect/ip_proto: inconsistent behavior when specifying protocol by string
Needs backport to 5.0, Needs backport to 6.0
ip_proto:TCP will use
getprotobyname, which may not work depending on the OS. E.g. in a docker Alpine it fails. We should probably just use a built-in table.