Fix to output a JSON buffer to an Unix domain socket.

Create the JSON buffer and write to it like regular file.

Upper function SCConfLogOpenGeneric already handle it properly.

Closes issue #1246.
Create a wrapper around DetectFlowvarProcessList() to check for empty list

Creates an inline wrapper to check for flowvarlist == NULL before calling
DetectFlowvarProcessList() to remove the overhead of checking since the
list is usually empty.
Enforce Signature Header structure matches Signature

Use a macro when defining the Signature Header and Signature structures
since the fields are required to match for correctness.
MPM: build sid list from MPM matches

Pmq add rule list: Array of uint32_t's to store (internal) sids from the MPM.

AC: store sids in the pattern list, append to Pmq::rule_id_array on match.

Detect: qsort rule_id_array after it was set up by the MPM. Rule id's
(Signature::num) are ordered, and the rule's with the lowest id are to
be inspected first. As the MPM doesn't fill the array in order, but instead
'randomly' we need this sort step to assure proper inspection order.

**TODO**:

Currently we use a new array 'rule_id_array'. However, in a few places,
the 'pattern_id_array' is used in a similar way (proto detect and perhaps
smtp?). So we could convert those to use the rule_id_array and remove the
pattern_id_array completely.
Detect: create per sgh non-MPM rule array

Array of rule id's that are not using MPM prefiltering. These will be
merged with the MPM results array. Together these should lead to a
list of all the rules that can possibly match.
Add negated MPM to non-MPM array (HACK)

Treat negated MPM sigs as if non-MPM, so we consider them always.

As MPM results and non-MPM rules lists are now merged and considered
for further inspection, rules that need to be considerd when a pattern
is absent are caught in the middle.

As a HACK/workaround this patch adds them to the non-MPM list. This
causes them to be inspected each time.

**TODO**
This will likely perform bad if there are a lot of rules using negated
MPM's. In the ET/ETpro rulesets those rules are quite rare though.
Replace build match array with new filter logic

Use MPM and non-MPM lists to build our match array. Both lists are
sorted, and are merged and sorted into the match array.

This disables the old match array building code and thus also bypasses
the mask checking.

**TODO**
See if we should reintroduce parts of the mask and other prefilter
logic.

**TODO**
Having a zero sized list is quite common for both lists, so we can
probably add some optimization for this.
detect: move checks from prefilter to rule detect

Move the prefilter checks to the main detect loop.

**TODO**
Review/test to what extend this is necessary.
AC: use local bit array (HACK)

Use a local pattern bit array to making sure we don't match more than
once, in addition to the pmq bitarray that is still used for results
validation higher up in the rule matching process.

Why: pmq->pattern_id_bitarray is currently sometimes used in a
'stateful' way, meaning that for a single packet we run multiple
MPM's on the same pmq w/o resetting it.

The new bitarray is used to determine wherther we need to append the
patterns associated 'sids' list to the pmq rule_id_array.

It has been observed that MPM1 matches for PAT1, and MPM2 matches for
PAT1 as well. However, in MPM1 PAT1 doesn't have the same sids list.
In this case MPM2 would not add it's sids to the list, leading to missed
detection.

**TODO**

Consider alternative solutions: e.g. make sure that each MPM runs
with it's own pmq. Then merge the pmq's using PmqMerge. Might perform
better than the stack alloc'd + memset'd bitarray in use now.
Fix AC-tile for new pattern ID array.
Implement MPM opt for b2g, b3g, wumanber

Found problems in b2gm and b2gc, so those are removed.
Optimize DetectPrefilterMergeSort

Fixup rebase changes to remove debug code

Conflicts:
	src/detect.c
Fix clang warning

Clang doesn't seem to like defining a function within a function.
Implement MPM opt for ac-bs and ac-gfbs

Copies sids changes from ac.
Dynamically resize pmq->rule_id_array

Rather than statically allocate 64K entries in every rule_id_array,
increase the size only when needed. Created a new function MpmAddSids()
to check the size before adding the new sids. If the array is not large
enough, it calls MpmAddSidsResize() that calls realloc and does error
checking. If the realloc fails, it prints an error and drops the new sids
on the floor, which seems better than exiting Suricata.

The size is increased to (current_size + new_count) * 2. This handles the
case where new_count > current_size, which would not be handled by simply
using current_size * 2. It should also be faster than simply reallocing to
current_size + new_count, which would then require another realloc for each
new addition.
Move type first in SigMatch array since it is used more often.
Prefetch the next signature pointer

Read one signature pointer ahead to prefetch the value.
Use a variable, sflags, for s->flags, since it is used many times and the
compiles doesn't know that the signatures structure doesn't change, so it
will reload s->flags.
Dynamically resize pattern id array as needed

Rather than creating the array of size maxpatid, dynamically resize as needed.
This also handles the case where duplicate pid are added to the array.

Also fix error in bitarray allocation (local version) to always use bitarray_size.
In AC-Tile, convert from using pids for indexing to pattern index

Use an MPM specific pattern index, which is simply an index starting
at zero and incremented for each pattern added to the MPM, rather than
the externally provided Pattern ID (pid), since that can be much
larger than the number of patterns. The Pattern ID is shared across at
MPMs. For example, an MPM with one pattern with pid=8000 would result
in a max_pid of 8000, so the pid_pat_list would have 8000 entries.

The pid_pat_list[] is replaced by a array of pattern indexes. The PID is
moved to the SCACTilePatternList as a single value. The PatternList is
also indexed by the Pattern Index.

max_pat_id is no longer needed and mpm_ctx->pattern_cnt is used instead.

The local bitarray is then also indexed by pattern index instead of PID, making
it much smaller. The local bit array sets a bit for each pattern found
for this MPM. It is only kept during one MPM search (stack allocated).

One note, the local bit array is checked first and if the pattern has already
been found, it will stop checking, but count a match. This could result in
over counting matches of case-sensitve matches, since following case-insensitive
matches will also be counted. For example, finding "Foo" in "foo Foo foo" would
report finding "Foo" 2 times, mis-counting the third word as "Foo".
Fix compiler warnings in ac-tile.

Signed vs unsigned comparisons.