Suricata

ldap.bind_request.authentication is an enum + an octet string...

Idea for ldap.request.bind.auth keyword : have it a sticky buffer but with required option, like ldap.request.bind.auth: sasl; content: "toto"; and the parser only accepts the 4 different auth mechanisms defined in ldap asn1

Following discussion on Discord, the agreed approach is:

- `ldap.bind_request.authentication` — enum keyword accepting simple or sasl
- `ldap.bind_request.sasl.mechanism` — sticky buffer exposing the SASL mechanism
- `ldap.bind_request.sasl.credentials` — sticky buffer exposing the SASL credentials

We won't add a sticky buffer for simple-bind credentials, as the intended simple-bind use case is to detect usage of simple bind, rather than to inspect the simple-bind credential contents.

updated PRs:
- https://github.com/OISF/suricata/pull/16183
- https://github.com/OISF/suricata-verify/pull/3354