rule_engine: check payload dicriminant before ruleset

[banditopazzo]

This pr introduces a new PayloadDiscriminant type to capture the rule type field.

Rulesets are stored per discriminant and tested after having checked the discriminant.

It also improves performances in case there are a lot of rules defined on a single payload type, because not these rules won't be checked for other types

Fix: #210

[vadorovsky]

Overall looks good. Is there any way to add a test, since we seem to have a clear reproducer of the issue?

[banditopazzo]

you can test the behaviour before and after this pr . you can use the examples from the original issue:

- name: Test curl request
  type: DnsQuery
  condition: header.image == "/usr/bin/curl"
- name: Test curl response
  type: DnsResponse
  condition: header.image == "/usr/bin/curl"

these both were matching on every curl events, or

- name: Test all requests
  type: DnsQuery
  condition: header.source == "network-monitor"

this was matching for every event from network-monitor.

And also this rule was incorrectly considered valid:

- name: Test curl response
  type: NonExistentEvent
  condition: header.image == "/usr/bin/curl"

After the changes it should be solved, considering the type even for conditions only on the payload

[banditopazzo]

Adding test it's hard o maybe impossible because Event fields are private and it's impossible to create inside rule-engine module

[vadorovsky]

Alright, then I'm happy to accept it as it is :)