decode: fix offset for DCE layer

[catenacyber]

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3637

Describe changes:

• decode: fix offset for DCE layer

Jason, it looks like your commit 95015a3 was right but got broken in between

I tested with the pcap found here https://community.cisco.com/t5/switching/nexus-7000-using-data-center-ethernet-with-fabricpath-not/td-p/3341478

But it is not good enough for a S-V test as OSPF does not create flows...

[codecov]

Codecov Report

Merging #9115 (792e83a) into master (d822ba5) will decrease coverage by 0.03%.
The diff coverage is 100.00%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9115      +/-   ##
==========================================
- Coverage   82.31%   82.28%   -0.03%     
==========================================
  Files         969      969              
  Lines      273722   273722              
==========================================
- Hits       225307   225225      -82     
- Misses      48415    48497      +82     

Flag	Coverage Δ
fuzzcorpus	64.55% <100.00%> (-0.05%)	⬇️
suricata-verify	60.64% <0.00%> (+0.04%)	⬆️
unittests	62.89% <0.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

[victorjulien]

Is a eve.stats based test possible? Or a decoder event based test to show absence of decode event rule match?

[suricata-qa]

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.flow.memuse	592373632	535275824	90.36%

Pipeline 14938

[catenacyber]

Is a eve.stats based test possible? Or a decoder event based test to show absence of decode event rule match?

Stats based test in OISF/suricata-verify#1289

Replaced by #9153