mqtt: improve rule support for detection

[satta]

Contribution style:

• I have read the contributing guide lines at
  https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html

Our Contribution agreements:

• I have signed the Open Information Security Foundation contribution agreement at
  https://suricata.io/about/contribution-agreement/ (note: this is only required once)

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7323

Describe changes:

• Include payloads of SUBACK in the detection of reason codes as well. This was missing before. Thanks @catenacyber for the hint.
• Revisit detection directions and adjust toclient/toserver flags considering that some messages can also be sent from the broker to the client.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#2106
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.40%. Comparing base (55b922c) to head (bdd20ff).
Report is 46 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11995      +/-   ##
==========================================
+ Coverage   82.75%   83.40%   +0.64%     
==========================================
  Files         910      910              
  Lines      249016   257618    +8602     
==========================================
+ Hits       206069   214855    +8786     
+ Misses      42947    42763     -184     

Flag	Coverage Δ
fuzzcorpus	61.55% <100.00%> (+0.73%)	⬆️
livemode	19.38% <50.00%> (+0.67%)	⬆️
pcap	44.44% <50.00%> (+0.31%)	⬆️
suricata-verify	62.77% <100.00%> (+0.48%)	⬆️
unittests	59.36% <50.00%> (+0.35%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

[jufajardini]

Thanks, do you think that the patch for the direction, that Philippe mentioned in the ticket, should also be added?

[satta]

Thanks, do you think that the patch for the direction, that Philippe mentioned in the ticket, should also be added?

Absolutely, working on it right now -- will then update this PR and open it for review.

[satta]

Removed draft status.

[jufajardini]

From what I can understand, this looks good, thank you. :)

[victorjulien]

Merged in #12088, thanks!

[catenacyber]

Thanks @satta :-)

[satta]

Thanks for finding these! 🤝