[Draft] detect/absent: Add error_or option to the absent keyword

[jlucovsky]

Add the error_or option to the absent keyword. This keyword matches when

• The inspection buffer has an error flag set
• The error flag is clear, and the following content matches

error_or must be used with a sticky buffer and must have a content keyword following it.

Example:

alert http any any -> any any ( msg:"Detect base64 decode error or malicious content"; \
    flow:established,to_server;  file.data; from_base64; absent: error_or; content:"malicious"; sid: 1; )

This alert triggers ifff

• file.data cannot be decoded with base64
• file.data can be decoded, and the decoded data contains the string malicious

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7114

Describe changes:

• Add the error_or option to the keyword
• Add logic to set/track inspection buffer errors
• Add logic to handle error_or during content inspection

Provide values to any of the below to override the defaults.

• To use a Suricata-Verify or Suricata-Update pull request,
  link to the pull request in the respective _BRANCH variable.
• Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2897
SU_REPO=
SU_BRANCH=

[catenacyber]

Why not use the existing absent: or_else ?

[codecov]

Codecov Report

❌ Patch coverage is 92.04545% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.16%. Comparing base (4b1b139) to head (4a9c039).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #14734      +/-   ##
==========================================
- Coverage   82.17%   82.16%   -0.01%     
==========================================
  Files        1008     1008              
  Lines      263938   263994      +56     
==========================================
+ Hits       216897   216920      +23     
- Misses      47041    47074      +33     

Flag	Coverage Δ
fuzzcorpus	60.20% <61.53%> (-0.01%)	⬇️
livemode	18.76% <11.53%> (+0.01%)	⬆️
netns	18.52% <0.00%> (+<0.01%)	⬆️
pcap	44.60% <15.38%> (-0.07%)	⬇️
suricata-verify	65.33% <84.61%> (-0.02%)	⬇️
unittests	59.35% <65.90%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[suricata-qa]

Information: QA ran without warnings.

Pipeline = 29364

[jlucovsky]

Why not use the existing absent: or_else ?

@victorjulien suggested this keyword in the ticket; however, it could be combined with absent and a new option, perhaps absent: error_or?

[suricata-qa]

Information: QA ran without warnings.

Pipeline = 29393