transform: Add case-changing transforms

[jlucovsky]

DRAFT: suricata-verify tests will be added soon

Add the transforms for changing the case of a buffer.

Link to redmine ticket: (6439)[https://redmine.openinfosecfoundation.org/issues/6439]

Describe changes:

• Add to_lowercase and to_uppercase transforms

Provide values to any of the below to override the defaults.

To use a pull request use a branch name like pr/N where N is the
pull request number.

Alternatively, SV_BRANCH may also be a link to an
OISF/suricata-verify pull-request.

SV_REPO=
SV_BRANCH=pr/1460
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=

[codecov]

Codecov Report

Merging #9761 (f6b21f8) into master (c8a7204) will decrease coverage by 0.18%.
The diff coverage is n/a.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9761      +/-   ##
==========================================
- Coverage   82.56%   82.39%   -0.18%     
==========================================
  Files         968      968              
  Lines      273827   273827              
==========================================
- Hits       226074   225607     -467     
- Misses      47753    48220     +467     

Flag	Coverage Δ
fuzzcorpus	64.29% <ø> (-0.57%)	⬇️
suricata-verify	60.96% <ø> (+<0.01%)	⬆️
unittests	62.93% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

[catenacyber]

Missing SV test ;-p

[victorjulien]

I think we should reject a sig like http.uri; to_uppercase; content:"lowercase"; or http.uri; to_lowercase; content:"UPPERCASE";

[suricata-qa]

Information: QA ran without warnings.

Pipeline 16438

[jlucovsky]

I think we should reject a sig like http.uri; to_uppercase; content:"lowercase"; or http.uri; to_lowercase; content:"UPPERCASE";

Good point. Would you like that addressed in this PR or a separate one?

[jlucovsky]

I think we should reject a sig like http.uri; to_uppercase; content:"lowercase"; or http.uri; to_lowercase; content:"UPPERCASE";

Good point. I'll update the PR with additional validation checks.

[jlucovsky]

Continued in #9786