Suricata

Instead of hard-coding in output examples for each protocol, we should generate from Suricata-Verify.

A possible way to do this is:

- Tag SV tests in such a way as examples, also provide their protocol name. This could allow existing tests be used.
- Periodically a script is run that runs SV and gathers sample output from tests and copies distinct records into files in the userguide.
- The userguide can then include these files.

Ideally SV tests that are tagged as examples are as complete as possible, containing all documented fields, however this might not always be possible.
Also allow for more than one example per protocol, as often multiple examples are needed to see request and response, or different message types.

The pcaps should be samll, and added to the Suricata repo, so the example documentation can be generated without an external repo like suricata-verify.