tls: fix negated match

A negated match is matching if the tested field is NULL. But as it
is not set, nor negated nor normal test must match.

Without this patch, a rule like:
 alert tls any any -> any any (msg:"negated match"; tls.subject:!"CN=home.regit.org"; sid:1; rev:1;)
is alerting for all connections. Event if they are done on a certificate
with matching subject. This was due to the fact that tls protocol
is discovered before the handshake is complete. Thus the condition
on tls is true with a NULL tls.subject. And code was returning a
positive match in the case of a NULL subject and a signature with
a negated match.
profiling: lower overhead when disabled

Instead of a large (6k+) structure in the Packet, make the profiling
storage dynamic. To do this the Packet->profile is now a pointer.

Initial support for selective sampling, e.g. only profile every
1000th packet.
profiling: conditional rule profiling

Add support for conditional rule profiling. Currently only simple
rate limiting is supported, but hardcoded to inspecting rules for
each packet.
profiling: add sample-rate yaml option

Add option "profiling.sample-rate":

  # Run profiling for every xth packet. The default is 1, which means we
  # profile every packet. If set to 1000, one packet is profiled for every
  # 1000 received.
  #sample-rate: 1000

This allows for configuration of the sample rate.
threading: add utility to get module id from name

Add TmModuleGetIdByName to go from module name to id directly.
profiling: support log api

The log API calls thread modules directly, so the TMM profiling logic
can be applied to it. This patch does so.

The "Thread Module" out now again lists the individual loggers. As the
module are normally called much less frequently the numbers are hard to
compare to pre-log-api numbers.
output: add TM_FLAG_LOGAPI_TM thread module flag

The TM_FLAG_LOGAPI_TM flag indicates that a module is run by the log
api, not by the 'regular' thread module call functions.

Set flag in all all Log API users' registration code.

Purpose of this flag is in profiling. In profiling output it will be
used to list log api thread modules separately.
threading: add missing json types to TmModuleTmmIdToString

Also, remove 'default' case from switch statement, so missing entries
will lead to a compiler warning.
profiling: fix percentage of detect phases

Use proper 'total' to calculate weigth of each detection phase.
profiling: output log api modules separately

Skip log api thread modules in the regular 'thread modules' list,
instead print them in a separate list.