Suricata

Further details from the commit message:

For example, when there are 2 rules
alert doh2 any any -> any any (dns.query; content: "www.gstatic.com"; sid:21; )
alert doh2 any any -> any any (http.request_header; content:"dns.google"; sid:31; )

Both dns.query and http.request_header engines are registered
with progress 1 in their respective alprotos: dns and http2

So, dns engine has is_last_for_progress = true, as the engines in
signature group heads are sorted by tx_min_progress then alproto

When prefilter runs a doh2 transaction,
- it first checks the dns engine,
- then it used to update tx->detect_progress beyond progress 1,
- and so in the next iteration of the loop, for the http.request_header
engine, we had tx->detect_progress > engine->ctx.tx_min_progress
and we skipped the http.request_header prefilter engine,

thus resulting in false negative.