Suricata

Pointed out by Jason: it would be better to have the exception policy stats counters outputted in such a format
that it is easier to search for stats under one key. Example suggestion:

stats: {
  exceptions: {
    tcp: {
      memcap: {
        pass_packet: 111,
      },
    },
  },
}

Instead of what we have:

stats: {
   tcp: {
      ssn_memcap_exception_policy: {
         pass_packet: 0,
         pass_flow: 0,
         bypass: 0,
         drop_packet: 0,
         drop_flow: 1,
         reject: 0
      }, 
   },
}

This suggestion seems to make sense to me, but it's certainly something to be discussed before moving on - to hopefully have something that we are happy
with, and can therefore be backported to 7.0.x (as once we do that, output changes will get more complicated).