packet_analysis: Introduce PacketAnalyzer::__disable_analyzer()

[awelzel]

@rsmmr - mind skimming if this goes into a direction that you think is okay for #2399? It exploits the fact that the manager is holding AnalyzerPtr's for the individual analyzers.

Will hookup Analyzer::disable_analyzer() and add a test or two, but in case something stands out better to know early.

[rsmmr]

Yes, that looks good to me. (I keep forgetting that packet analyzers are instantiated only once, so yes, putting the state right in the analyzer makes sense).

[awelzel]

Yes, that looks good to me. (I keep forgetting that packet analyzers are instantiated only once, so yes, putting the state right in the analyzer makes sense).

I'm marking this ready. I'm uncertain about the Analyzer::disable_analyzer() extension: It seems nice to have a single entry point and be able to reuse the Analyzer::disabled_analyzers mechanism, but could also see it being separated/duplicated in the PacketAnalyzer module over at scripts/base/packet-protocols/main.zeek to not mix up the different analyzers.

@rsmmr - mainly looking for opinion/guidance here. Over in the issue you mentioned extending the existing one and the current state is my interpretation of that :-)

And I think we could then also extend the script-side disable_analyzer to support packet analyzers as well.

[rsmmr]

I like it this way. So ready to merge?

And ... what about file analyzers? Want to extend disable_analyzer to that next?