doc/pcre: note that flow captures need a flow

Add a note to the pcre extraction section stating that a flow: capture
is dropped when the packet is inspected without a flow, and that such a
packet still alerts.

ICMPv4 error messages are one way to get such a packet: FlowCreateCheck
returns false for them, while DecodeICMPV4 has already set p->payload,
so they reach the detection engine with something to inspect and nowhere
to store a flow variable. A packet the flow engine could not give a flow
to once the memcap was reached and no used flow could be reclaimed is
the other.

The pkt: and alert: scopes described in the same section are unaffected,
because a packet variable is stored on the packet and an alert variable
on the alert.

Issue: 8862

doc/userguide/rules/payload-keywords.rst

@@ -1032,6 +1032,11 @@ With that syntax, the result of the extraction will appear like ::
 
 A combination of the extraction scopes can be combined.
 
+.. note:: A ``flow:`` capture needs a flow to store into. Some packets are
+   inspected without one -- ICMPv4 error messages, for example, or a packet
+   that could not be given a flow because the flow memcap was reached. Those
+   packets can still alert, but their ``flow:`` captures are dropped.
+
 It is also possible to extract key/value pair in the ``pkt`` scope.
 One capture would be the key, the second the value. The notation is similar to the last ::