detect/firewall: fix 'last_for_progress' logic

If the last signature in the candidates list is also the last for the
current progress value, it needs to be considered as the last for that
progress, so that if it doesn't match the default policy is applied.

src/detect.c

@@ -1607,6 +1607,7 @@ static int DetectRunTxCheckFirewallPolicy(DetectEngineThreadCtx *det_ctx, Packet
                 SCLogDebug("peek: there are no rules to allow the state after this rule");
                 *fw_next_progress_missing = true;
             }
+            *last_for_progress = true;
         }
 
         if ((*skip_fw_hook) == true) {