stream: handle extra different SYN/ACK

Until now, when processing the TCP 3 way handshake (3whs), retransmissions
of SYN/ACKs are silently accepted, unless they are different somehow. If
the SEQ or ACK values are different they are considered wrong and events
are set. The stream events rules will match on this.

In some cases, this is wrong. If the client missed the SYN/ACK, the server
may send a different one with a different SEQ. This commit deals with this.

As it is impossible to predict which one the client will accept, each is
added to a list. Then on receiving the final ACK from the 3whs, the list
is checked and the state is updated according to the queued SYN/ACK.
Coverity 1005133: fix unlikely case where malformed pcre statement in rule would lead to null-deref.
Coverity 1005134: fix minor memory leak on flowvar rule setup errors.
flowvar: cleanup keyword argument parsing. Should also address Coverity 400655.
file: make fileext, filename and filemagic use the same rule parsing function as others. This has as a side effect that we enforce doubly qouted values now.
Remove obsolete DetectParseContentString function, it has been replaced by DetectContentDataParse
Remove filemagic debug statement
Update DetectContentDataParse to reflect the actual data types content uses.
streaming: randomize chunk size

By randomizing chunk size around the choosen value, it is possible
to escape some evasion technics that are using the fact they know
chunk size to split the attack at the correct place.
This patch activates randomization by default and set the random
interval to chunk size value +- 10%.
stream: default 'random' setting when running unittests is disabled, so that test results are predictable.
Bug 794: stream SACK list needs to respect memcap
Bug 780 unittests, showing no problem.
UDP: inspection app layer state as soon as we have it.
Suppress warnings when StreamSegmentForEach is called for UDP or SCTP, unless debug is compiled in.
unified2: only call stream callback for TCP
prelude: only call stream callback for TCP
profiling: enabled app layer profiling for UDP app layer modules
unified2: more udp fixes
alert-debuglog: cleanup TCP check
nfq: avoid extra copy when running in workers mode

currently, the packet payload recv()d from the nfqueue netlink
socket is copied into a new packet buffer.

This is required because the recv-buffer space used is tied
to the current thread, but a packet may be handed off to other
threads, and the recv-buffer can be re-used while the packet
is handled by another thread.

However, in worker runmode, the packet will always be handled
by the current thread, and the recv-buffer will only be reused
after the entire packet processing stack is done with the packet.

Thus, in worker runmode, we can avoid the copy and assign
the packet data area directly.