decode/ethertype: Event on unknown ethertype

[jlucovsky]

Continuation of #11410

Issue: 7129

Create a decode/engine event if unknown ethertypes are observed.

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7129

Describe changes:

• Add an event created when unknown ethertypes are observed
• Update schema with event counter
• Add rule for event.

Updates

• Event rule is now thresholded to reduce alert counts
• Documentation updates

Provide values to any of the below to override the defaults.

• To use an LibHTP, Suricata-Verify or Suricata-Update pull request,
  link to the pull request in the respective _BRANCH variable.
• Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#1954
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.00%. Comparing base (eeec609) to head (51730fa).

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11442      +/-   ##
==========================================
- Coverage   82.44%   79.00%   -3.45%     
==========================================
  Files         938      938              
  Lines      248068   247892     -176     
==========================================
- Hits       204513   195838    -8675     
- Misses      43555    52054    +8499     

Flag	Coverage Δ
fuzzcorpus	60.53% <100.00%> (+0.43%)	⬆️
livemode	18.72% <100.00%> (+0.01%)	⬆️
pcap	43.78% <100.00%> (+0.06%)	⬆️
suricata-verify	?
unittests	59.43% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

WARNING:

field	baseline	test	%
	SURI_TLPW1_stats_chk
.decoder.invalid	75	756	1008.0%
	SURI_TLPR1_stats_chk
.decoder.invalid	194	902190	465046.39%

Pipeline 21403

[jlucovsky]

Continued in #11455