detect: log app-layer metadata in alert with single tx

[catenacyber]

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/7199

May also solve https://redmine.openinfosecfoundation.org/issues/7406 and https://redmine.openinfosecfoundation.org/issues/7350

Describe changes:

• detect: log app-layer metadata in alert with single tx

SV_BRANCH=OISF/suricata-verify#2141

Is this the right way to solve most of the cases as I remember discussing with someone ?

#12153 with unit test fix by checking the packet has a flow with app-layer state

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 49.84%. Comparing base (bd7d38e) to head (9cdbb91).

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #12158      +/-   ##
==========================================
+ Coverage   49.81%   49.84%   +0.03%     
==========================================
  Files         909      909              
  Lines      257904   257905       +1     
==========================================
+ Hits       128467   128557      +90     
+ Misses     129437   129348      -89     

Flag	Coverage Δ
fuzzcorpus	61.03% <100.00%> (+0.08%)	⬆️
livemode	19.43% <100.00%> (+<0.01%)	⬆️
pcap	44.44% <100.00%> (+0.03%)	⬆️
suricata-verify	62.75% <100.00%> (+<0.01%)	⬆️
unittests	8.98% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[tugtugtug]

@catenacyber as I replied to https://redmine.openinfosecfoundation.org/issues/7406?issue_count=370&issue_position=4&next_issue_id=7398&prev_issue_id=7407, I think it is a lot more readable with the
if (pflow && pflow->alstate) in the outer if, so,

        if (pflow && pflow->alstate) {
            if ((alert_flags & PACKET_ALERT_FLAG_STREAM_MATCH) ||
                (s->alproto != ALPROTO_UNKNOWN && pflow->proto == IPPROTO_UDP) ||
                (AppLayerParserGetTxCnt(pflow, pflow->alstate) == 1))
            {
                // if there is a stream match (TCP), or
                // a UDP specific app-layer signature,
                // or only one transaction
                // try to use the good tx for the packet direction
                ....
            }
        }

[suricata-qa]

Information: QA ran without warnings.

Pipeline 23573

[catenacyber]

Right, I have an even better fix coming in #12161 removing the second later check to pflow->alstate