firewall: apply flow scope to the default packet policy drop

The packet default policy runtime only applied the action scope for
`accept`. For `drop:flow` and `reject:flow` it dropped the packet and left
the flow untouched, so the flow scope had no effect.

Backport adaptations: the flow drop sets `FLOW_ACTION_DROP` and
`FLOW_AUX_ACTION_BY_FIREWALL` directly, like the other 8.0.x flow drops,
as 8.0.x has no `FlowSetDropAction()`. The debug log reads `p->pcap_cnt`,
as 8.0.x has no `PcapPacketCntGet()`.

Ticket: 8970
(cherry picked from commit 6fe3a3dfc3)

src/detect.c

@@ -696,6 +696,11 @@ static uint8_t DetectRunApplyPacketPolicy(const DetectEngineCtx *de_ctx,
         SCLogDebug(
                 "packet %" PRIu64 ": drop PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY", p->pcap_cnt);
         PacketDrop(p, pol->action, PKT_DROP_REASON_FW_DEFAULT_PACKET_POLICY);
+        if (p->flow && pol->action_scope == ACTION_SCOPE_FLOW) {
+            p->flow->flags |= FLOW_ACTION_DROP;
+            p->flow->aux_flags |= FLOW_AUX_ACTION_BY_FIREWALL;
+            SCLogDebug("packet %" PRIu64 ": drop scope flow", p->pcap_cnt);
+        }
     } else if (pol->action & ACTION_ACCEPT) {
         SCLogDebug("packet %" PRIu64 ": accept", p->pcap_cnt);
         if (pol->action_scope == ACTION_SCOPE_PACKET) {