Suricata

When specifying e.g. `accept:hook,pass`, the rule is parsed. Internally it tries to reuse the scope of the previous actions (hook), but pass only works on packets/flows scopes.

Also `pass` hook can be combined with incompatible primary hooks (drop/reject) but should be only compatible with an accept hook.

As part of this ticket also disallow config action to be part of default policies.