decode/ethertype: Event on unknown ethertype

[jlucovsky]

Continuation of #11455

Issue: 7129

Create a decode/engine event if unknown ethertypes are observed.

Link to ticket: https://redmine.openinfosecfoundation.org/issues/7129

Describe changes:

• Add an event created when unknown ethertypes are observed
• Update schema with event counter
• Add rule for event.

Updates

• The events are no longer counted under the decoder.invalid stats; the existing decoder.unknown_ethertype stat is used.

Provide values to any of the below to override the defaults.

• To use an LibHTP, Suricata-Verify or Suricata-Update pull request,
  link to the pull request in the respective _BRANCH variable.
• Leave unused overrides blank or remove.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#1954
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.46%. Comparing base (7f6c963) to head (09454b0).

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #11546      +/-   ##
==========================================
- Coverage   82.51%   82.46%   -0.06%     
==========================================
  Files         923      923              
  Lines      248732   248739       +7     
==========================================
- Hits       205232   205113     -119     
- Misses      43500    43626     +126     

Flag	Coverage Δ
fuzzcorpus	60.44% <100.00%> (+0.04%)	⬆️
livemode	18.79% <100.00%> (+0.16%)	⬆️
pcap	43.99% <100.00%> (-0.09%)	⬇️
suricata-verify	61.67% <100.00%> (-0.09%)	⬇️
unittests	59.06% <75.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[suricata-qa]

Information: QA ran without warnings.

Pipeline 21694

[jlucovsky]

Continued in #11557