Suricata

As the detection_filter keyword hasn't been properly tested in firewall mode,
we must add tests with different scenarios before flagging it as actually supported.
For now, we'll flag it as unsupported, to avoid unintended behavior and interactions with
firewall mode and firewall actions.

First step:
- add SV tests to pin current behavior in IPS and IDS mode
- update existing firewall/tcp-session-syn-flood-drop-precedence test to actually show the current
state and behavior in Firewall mode (the test is missing a couple of important checks that hide
existing issues in using detection_filter in firewall rules)