Suricata

Currently we have an issue where in detect-engine-alert.c we set PASS on the 'root' pkt, but check it on the tunneled (fake) packet. This leads to FP as reported on oisf-users.

Instead of fixing what we have, lets backport the packet action macro's from master, as master doesn't have this problem because it uses the TEST macro.