eve: add rule generation source to alert record - v1

[jasonish]

Ticket: https://redmine.openinfosecfoundation.org/issues/8456

SV_BRANCH=OISF/suricata-verify#3072

Draft to see how "alert.engine" feels... Examples:

"alert": {
  "engine": "fw"
}

"alert": {
  "engine": "td"
}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.64%. Comparing base (8968b1c) to head (7463306).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #15335      +/-   ##
==========================================
- Coverage   82.66%   82.64%   -0.03%     
==========================================
  Files         995      995              
  Lines      271046   271048       +2     
==========================================
- Hits       224069   224000      -69     
- Misses      46977    47048      +71     

Flag	Coverage Δ
fuzzcorpus	61.05% <50.00%> (-0.01%)	⬇️
livemode	18.37% <50.00%> (-0.02%)	⬇️
netns	22.57% <100.00%> (-0.07%)	⬇️
pcap	45.21% <50.00%> (-0.02%)	⬇️
suricata-verify	66.38% <100.00%> (-0.02%)	⬇️
unittests	58.57% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[suricata-qa]

Information: QA ran without warnings.

Pipeline = 31277

[victorjulien]

In other parts of the firewall logic I referred to the IDS/IPS rules as "td" (threat detection). I think it would make sense to use that here as well.

[jasonish]

In other parts of the firewall logic I referred to the IDS/IPS rules as "td" (threat detection). I think it would make sense to use that here as well.

Makes sense. Updated to be td.

[jasonish]

Suggested change

	"description": "Engine that generated the alert in firewall mode: fw for firewall rules, td for threat detect rules."
	"description": "Engine that generated the alert in firewall mode: fw for firewall rules, td for threat detection rules."

[jasonish]

Suggested change

	generated the alert: ``fw`` for firewall rules and ``td`` for threat detect
	generated the alert: ``fw`` for firewall rules and ``td`` for threat detection

[jasonish]

I didn't like engine at first, and didn't have any other ideas. But I think its growing on me.

I could imagine some post-processing engine in the future, or something...

[suricata-qa]

WARNING:

field	baseline	test	%
	SURI_TLPW2_single_stats_chk
.uptime	1355	1397	103.1%

Pipeline = 31301