firewall: apply flow scope to the default packet policy drop

The packet default policy runtime only applied the action scope for
`accept`. For `drop:flow` and `reject:flow` it dropped the packet and left
the flow untouched, so the flow scope had no effect.

Ticket: 8969

src/detect.c

@@ -710,6 +710,10 @@ static uint8_t DetectRunApplyPacketPolicy(const DetectEngineCtx *de_ctx,
         SCLogDebug("packet %" PRIu64 ": drop PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY",
                 PcapPacketCntGet(p));
         PacketDrop(p, pol->action, PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY);
+        if (p->flow && pol->action_scope == ACTION_SCOPE_FLOW) {
+            FlowSetDropAction(p->flow, FLOW_ACTION_BY_FIREWALL);
+            SCLogDebug("packet %" PRIu64 ": drop scope flow", PcapPacketCntGet(p));
+        }
     } else if (pol->action & ACTION_ACCEPT) {
         SCLogDebug("packet %" PRIu64 ": accept", PcapPacketCntGet(p));
         if (pol->action_scope == ACTION_SCOPE_PACKET) {