Support Suricata transactional rule direction

[tosto92]

Summary

Adds support for Suricata transactional rules using the => direction operator.

Suricata supports transactional rules with source => destination, documented here:
https://docs.suricata.io/en/latest/rules/intro.html#transactional-rules

The SOC Suricata rule parser only recognized directions beginning with < or - and only accepted <> or ->. As a result, valid transactional rules failed validation before reaching Suricata.

Changes

• Allow = to start the rule direction token.
• Accept => as a valid Suricata direction alongside -> and <>.
• Update invalid-direction error text.
• Add parser coverage for transactional rules.
• Add ruleset parsing coverage to verify imported/custom rules using => are accepted.

Impact

This allows valid Suricata transactional rules to be:

• created or updated through the SOC web UI
• imported from local/custom rulesets during Suricata ruleset sync

Suricata itself still performs final rule validation, so invalid transactional rule syntax or unsupported keyword combinations will continue to fail at the engine level.

Validation

go test -count=1 ./server/modules/suricata

Result:

ok   github.com/security-onion-solutions/securityonion-soc/server/modules/suricata

[defensivedepth]

Thanks for the PR @tosto92

It has been queued for review.