Applayer plugin 5053 v7

[catenacyber]

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/4102 with all 6 subtickets

Describe changes:

• add app-layer plugin example with template protocol
• document app-layer plugins

@jufajardini what do you think about the doc ?

@jasonish as you created the tickets, is this what you expected ?

Follows #12441

Draft: Commit POC: suricata-plugin crate is a POC to discuss

I think we want

• pure rust app-layer plugins, that look like one app-layer code in Suricata
• plugins can import somehow from Suricata :
  • type definitions like AppProto,
  • constants like ALPROTO_UNKNOWN,
  • enum like AppLayerEventType::APP_LAYER_EVENT_TYPE_TRANSACTION
  • Struct definitions like SCAppLayerPlugin
  • Opaque definitions like Flow (for better code readability of callbacks)
  • Suricata C functions to use like `AppLayerRegisterProtocolDetection

Alternatives are

• plugin redefines all these in some suricata.rs file : works but not nice
• plugin has a dependency on Suricata crate : not sure it works, but not nice as well as it makes the plugin compile the 200 dependencies of Suricata
• plugin has a dependency on a light (0 dependency) Suricata plugin crate, whose code gets somehow generated from Suricata rust code

@jasonish

• Is the problem well established this way ?
• Do you see other alternatives ?
• Is the last alternative looking the best to you as well ? (suricata plugin crate with code that gets generated from Suricata rust code)

[catenacyber]

Maybe I should emphasize that plugin code and Suricata code must be well separated and only communicate through the lingua-franca C API

[catenacyber]

Talking with Jason, he thinks the second alternative is better...

I will give it a shot, limiting my time on it...