detect: add requires keyword

Add a new rule keyword "requires" that allows a rule to require specific
Suricata versions and/or Suricata features to be enabled.

Example:

  requires: feature geoip, version >= 7.0.0, version < 8;

Feature: OISF#5972

Co-authored-by: Philippe Antoine <pantoine@oisf.net>

doc/userguide/rules/meta.rst

@@ -211,3 +211,29 @@ The format is::
 If the value is src_ip then the source IP in the generated event (src_ip
 field in JSON) is the target of the attack. If target is set to dest_ip
 then the target is the destination IP in the generated event.
+
+requires
+--------
+
+The ``requires`` keyword allows a rule to require specific Suricata
+features to be enabled, or the Suricata version to match an
+expression. Rules that do not meet the requirements will by ignored,
+and Suricata will not treat them as errors.
+
+The format is::
+
+   requires: feature geoip, version >= 7.0.0
+
+To require multiple features, the feature sub-keyword must be
+specified multiple times::
+
+   requires: feature geoip, feature lua
+
+The version sub-keyword may also be present multiple times, for
+example a rule may express that it is for Suricata verisons greater
+than or equal to 7.0.3, but less than version 8::
+
+   requires: version >= 7.0.4, version < 8
+
+If no *minor* or *patch* version component is provided, it will
+default to 0.

rust/src/detect/mod.rs

@@ -24,3 +24,4 @@ pub mod parser;
 pub mod stream_size;
 pub mod uint;
 pub mod uri;
+pub mod requires;