detect: use sub state to select inspect engines

When building the per signature app_inspect list, only add engines
that match the sub state specified in the hook.

src/detect-engine.c

@@ -742,6 +742,11 @@ static void AppendAppInspectEngine(DetectEngineCtx *de_ctx,
             if (!(AppProtoEqualsStrict(s->alproto, t->alproto))) {
                 return;
             }
+
+            /* skip engines not for us */
+            if (s->init_data->hook.t.app.sub_state != t->sub_state) {
+                return;
+            }
         } else {
             /* other rules use the more relax AppProtoEquals logic */
             if (!AppProtoEquals(s->alproto, t->alproto)) {

src/detect-parse.c

@@ -2869,6 +2869,8 @@ static int SigValidateCheckBuffers(
                 if (!(AppProtoEqualsStrict(s->alproto, app->alproto))) {
                     continue;
                 }
+                if (app->sub_state != s->init_data->hook.t.app.sub_state)
+                    continue;
             } else {
                 if (!(AppProtoEquals(s->alproto, app->alproto) || s->alproto == 0)) {
                     continue;