doc: update file keywords v1

[jmtaylor90]

Make sure these boxes are signed before submitting your Pull Request -- thank you.

• I have read the contributing guide lines at https://docs.suricata.io/en/latest/devguide/codebase/contributing/contribution-process.html
• I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/
• I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

Link to redmine ticket:

Describe changes:

• Update file.magic and file.name keyword information to reflect recent updates
• Update libmagic dependency information and reference

Provide values to any of the below to override the defaults.

To use a pull request use a branch name like pr/N where N is the
pull request number.

Alternatively, SV_BRANCH may also be a link to an
OISF/suricata-verify pull-request.

SV_REPO=
SV_BRANCH=
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

[codecov]

Codecov Report

Merging #9245 (537d7dd) into master (9fd77c7) will decrease coverage by 0.01%.
The diff coverage is n/a.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9245      +/-   ##
==========================================
- Coverage   82.40%   82.39%   -0.01%     
==========================================
  Files         968      968              
  Lines      273952   273952              
==========================================
- Hits       225760   225733      -27     
- Misses      48192    48219      +27     

Flag	Coverage Δ
fuzzcorpus	64.65% <ø> (+<0.01%)	⬆️
suricata-verify	60.78% <ø> (-0.03%)	⬇️
unittests	62.93% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

[jufajardini]

Related to: https://redmine.openinfosecfoundation.org/issues/6194
but not sure if we need a new ticket for the doc update in this case.

[jufajardini]

Looks good to me, but as this may be the solution requested by @catenacyber in https://redmine.openinfosecfoundation.org/issues/437, let's wait for his feedback, too :)

[victorjulien]

this is no longer true:

filename:"secret"; is now equivalent to file.name; content:"secret"; nocase;

Similarly, fileext:
fileext:pdf; is equivalent to file.name; content:".pdf"; nocase; endswith;. Note the dot that is prepended to pdf.

This is handled at parsing, so at runtime this is identical in behavior and performance.

btw we're looking at backporting this optimization to 6: https://redmine.openinfosecfoundation.org/issues/6203

[victorjulien]

This incorrect. filemagic is the legacy notation, that uses:
filemagic:"Windows";
file.magic is the new implementation:
file.magic; content:"Windows"; nocase;

Note that like with filename above, the difference exists only during parsing in 7.

[victorjulien]

perf should now be identical

[victorjulien]

see inline comments

[jmtaylor90]

continued in #9316