Create pfdetect_SO

Adding this as a new file because it will break the current way PF parses SNORT logs if it replaced the stock pfdetect.

With a separate file it is possible to run this version and the stock version at the same time should you be crazy and have both system deployed.

It is a copy of the current pfdetect with the parsing logic re-written for use with Security Onion.