detect: allow banning kw from td in firewall mode

In case a keyword should work in firewall mode, with firewall rules
only. The engine errors out if threat detection rules use the given keyword.

Part of
Ticket #9041

Backport note: main-8.0.x has 16-bit sigmatch flags defined with BIT_U16() in
src/detect.h and no SIGMATCH_* constants in rust/sys, and lacks the
SIGMATCH_BAN_FIREWALL_RULE/MODE flags that surround this change on main.
SIGMATCH_BAN_TD_FIREWALL_MODE is defined as BIT_U16(14) in src/detect.h, the
rust/sys hunk is dropped, and only the new feature-list and parser checks are
added.

(cherry picked from commit d4aa40df61)

src/detect-engine-register.c

@@ -330,6 +330,12 @@ static void PrintFeatureList(const SigTableElmt *e, char sep)
         printf("supports firewall");
         prev = 1;
     }
+    if (flags & SIGMATCH_BAN_TD_FIREWALL_MODE) {
+        if (prev == 1)
+            printf("%c", sep);
+        printf("not supported in threat detection rules in firewall mode");
+        prev = 1;
+    }
     if (e->Transform) {
         if (prev == 1)
             printf("%c", sep);

src/detect-parse.c

@@ -1007,6 +1007,13 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
 #undef URL
     }
 
+    /* For non-firewall rules */
+    if (EngineModeIsFirewall() && !s->init_data->firewall_rule &&
+            (st->flags & SIGMATCH_BAN_TD_FIREWALL_MODE) != 0) {
+        SCLogError("keyword \'%s\' is not supported in threat detection rules with firewall mode",
+                optname);
+        goto error;
+    }
     int setup_ret = 0;
 
     /* Validate double quoting, trimming trailing white space along the way. */

src/detect.h

@@ -1731,6 +1731,8 @@ typedef struct SigGroupHead_ {
 #define SIGMATCH_SUPPORT_FIREWALL BIT_U16(12)
 /** keyword supporting setting an optional direction */
 #define SIGMATCH_SUPPORT_DIR BIT_U16(13)
+/** keyword cannot be used in td rules with firewall mode */
+#define SIGMATCH_BAN_TD_FIREWALL_MODE BIT_U16(14)
 
 enum DetectEngineTenantSelectors
 {