detect/dataset: fix dataset set logic

[regit]

The set operation of dataset keyword was not done only signature when there is a full match. This was not correct with regards to expectation.

Make sure these boxes are signed before submitting your Pull Request -- thank you.

• I have read the contributing guide lines at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Contributing
• I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/
• I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

Link to redmine ticket:

Describe changes:

• Move dataset set to post match
• Keep backward compat

suricata-verify-pr: 959

[codecov]

Codecov Report

Merging #8114 (6953aac) into master (2f9ca8b) will increase coverage by 0.07%.
The diff coverage is 83.58%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #8114      +/-   ##
==========================================
+ Coverage   81.51%   81.59%   +0.07%     
==========================================
  Files         958      958              
  Lines      276148   276211      +63     
==========================================
+ Hits       225099   225367     +268     
+ Misses      51049    50844     -205     

Flag	Coverage Δ
fuzzcorpus	63.64% <83.58%> (+0.28%)	⬆️
suricata-verify	58.98% <83.58%> (-0.01%)	⬇️
unittests	63.36% <1.49%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[victorjulien]

I think the commit message should do a better job of explaining the problem followed by the suggested solution. Its very minimal currently.

I don't think it is necessary or efficient to make a copy of the buffer. During the lifetime of the rule inspection the buffer shouldn't change. Not sure if it is easily accessible, but a pointer to (or index into) the InspectionBuffer that holds the inspected data could be set aside and used by the actual Set.

[victorjulien]

see comment

[suricata-qa]

WARNING:

field	baseline	test	%
	TREX_GENERIC_stats_chk
.capture.kernel_drops	0	140022	-
.flow.end.tcp_state.syn_sent	0	251	-
.flow.end.tcp_state.syn_recv	0	1	-
.flow.end.tcp_state.fin_wait1	0	40	-
.flow.end.tcp_state.fin_wait2	0	17	-
.flow.end.tcp_state.time_wait	0	27	-
.flow.end.tcp_state.last_ack	0	8	-
.flow.end.tcp_state.close_wait	0	57	-
.tcp.reassembly_gap	80952	100373	123.99%
.app_layer.error.http.parser	0	27	-
.app_layer.error.ftp.gap	0	1	-
.app_layer.error.smtp.gap	0	20	-
.app_layer.error.dcerpc_tcp.parser	0	5	-

Pipeline 10288