runmode: remove unused variable.

default_mode_auto is not used anymore and can be removed.
classification: add category to some stream rules

All stream events signatures deserve a category.
ssh: reenable parser as stub

Reenable the SSH parser. It now compiles, however the actual parsing
code is still disabled (commented out).
ssh: record parser
ssh: server support, cleanups
ssh: handle fragmented banner

Cleanups.
ssh: reenable ssh.softwareversion keyword
ssh: reenable ssh.protoversion keyword
ssh: clean up flags
ssh: allow for space characters in the software version

Previously the software version would only contain up to the first
space.

E.g. in SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu3

It would contain "OpenSSH_4.7p1".

This patch changes the behavior to:

"OpenSSH_4.7p1 Debian-8ubuntu3"
ssh: disable inspection in encrypted phase

When both sides of the session have completed the encryption setup,
flag the stream to disable detection.
ssh: improve large and fragmented banner handling

Including tests.
ssh: add json logger

Sub module of eve-log, but can also run separately as ssh-json-log. Only
one at a time though.
ssh: fixes for minor scan-build warnings

/usr/share/clang/scan-build/ccc-analyzer -DHAVE_CONFIG_H -I. -I..   -I./../libhtp/  -I/usr/include/nspr   -I/usr/include/nss -I/usr/include/nspr   -DLOCAL_STATE_DIR=\"/usr/local/var\" -g -O2 -Wall -Wno-unused-parameter -std=gnu99 -DHAVE_LIBNET11 -D_BSD_SOURCE -D__BSD_SOURCE -D__FAVOR_BSD -DHAVE_NET_ETHERNET_H -DHAVE_LIBNET_ICMPV6_UNREACH  -I/usr/include -DLIBPCAP_VERSION_MAJOR=1 -DHAVE_PCAP_SET_BUFF -DHAVE_LIBCAP_NG -DREVISION="51e0dee" -MT app-layer-ssh.o -MD -MP -MF .deps/app-layer-ssh.Tpo -c -o app-layer-ssh.o app-layer-ssh.c
app-layer-ssh.c:164:5: warning: Value stored to 'input' is never read
    input += 1;
    ^        ~
app-layer-ssh.c:165:5: warning: Value stored to 'input_len' is never read
    input_len -= 1;
    ^            ~
app-layer-ssh.c:212:13: warning: Value stored to 'ret' is never read
            ret = 0;
            ^     ~
3 warnings generated.
ssh: improve banner checking

Don't use input_len as banner length. Instead, look for banner end
to calculate banner length.

Add test for banner buffering corner case.
ssh: fix scan-build warnings

app-layer-ssh.c:165:5: warning: Value stored to 'input_len' is never read
    input_len -= 1;
    ^            ~
1 warning generated.

app-layer-ssh.c:160:5: warning: Value stored to 'input_len' is never read
    input_len -= 4;
    ^            ~
1 warning generated.