escape some addt chars to keep snort happy

basically:

1) escape reserved chars for snorts msg: field (current code only escapes content: field)
2) convert pipes to |7c| because snort doesnt like \| and if you have two pipes in CIF it will make snort cranky

so 

msg: "blah &amp; blah"
becomes
msg: "blah &amp\; blah"

and

content: "hi || mom!"
becomes
content: "hi |7c||7c| mom!"

with this patch