Fix ib_strstr to actually work correctly when the haystack is smaller
than the needle
tests: Add a unit test for ib_strstr() where needle is bigger than haystack.
core_actions.c: Make a copy of the rule tags when adding them to an event. RNS-1243