dns: rules files was not installed

Installed dns-events.rules files in rules directory with install-rules.
yaml: remove no more present files

emerging-virus.rules is not present anymore in ET ruleset downloaded
by 'make install-rules'. This patch removes it from the list to avoid
an error message.
erf-dag: fix typo in header guard

Spotted out by clang:
 source-erf-dag.h|25 col 9| warning: '__SOURCE_ERR_DAG_H__'
 is used as a header guard here, followed by #define of a different macro
 [-Wheader-guard]
stream: add option to disable raw reassembly

Raw reassembly is used only by the detection engine. For users only
caring about logging it's a significant overhead, both in cpu and
memory usage.

The option is called 'raw' and lives under the stream.reassembly
options.

stream:
  memcap: 32mb
  checksum-validation: yes      # reject wrong csums
  inline: auto                  # auto will use inline mode in IPS mode, yes or no set it statically
  reassembly:
    memcap: 64mb
    depth: 1mb                  # reassemble 1mb into a stream
    toserver-chunk-size: 2560
    toclient-chunk-size: 2560
    randomize-chunk-size: yes
    #randomize-chunk-range: 10
    raw: false # <- new option
flow/stream: use named values in flow timeout code
flow timeout cleanup and fix

Flow timeout code worked by luck when checking if a flow still needed
reassembly for app layer inspection or logging. It would check for a
part of raw reassembly (smsg list) to determine if detection was
needed. In this case it would also process app layer cleanup,
including logging.

Introduced AppLayerTransactionGetActive which returns the lowest tx_id
in a direction that still needs some work.

FlowForceReassemblyNeedReassmbly now uses it to determine if the
applayer still needs work.

Converted FlowForceReassemblyForHash to use the checking function
FlowForceReassemblyNeedReassmbly as well, so that checking if a flow
needs work is now unified.
flow: fix typo in function name

FlowForceReassemblyNeedReassmbly -> FlowForceReassemblyNeedReassembly
flow timeout: remove now unused code
pcap: fix stats dump logic

pcap has a callback function that is called for each packet. Once a
second, it's meant to 'dump stats'. However, the timing logic was
broken, so it would actually dump stats for each packet.

By moving the stats second timer into the thread vars, next calls of
the callback will be able to use the stored time.
flowvar: initialize new memory to prevent issues on error handling
Convert Flow macros to inline functions

Convert FlowReference and FlowDeReference to inline functions for
better readability and to aid static code analyzers.
log-http: enforce hostname print limit
log-http: fix error check leading to null-deref on malloc failure during setup
New method to deep copy a configuration node.

The upcoming YAML alias support will require
deep copies of nodes to be created instead of just
pointers.  This is required to retain the child
parent relationship of the nodes, as well as to
allow a copy to be modified without affecting the
original.
Add anchors to configuration values and allow lookups by anchor.
Support YAML anchors and aliases.

When mapping or value is seen to have an anchor, record
that anchor.  When an alias is found, lookup the alias in
the configuration and copy the values over.