ids: add DNS, flow, stats EVE output types and community-id toggle

[mbedworth]

Summary

Extends the EVE log configuration with additional output types, following the pattern established for HTTP and TLS in #7775.

New configurable EVE output types (all disabled by default, under Advanced):

• DNS — logs DNS transactions with optional query/answer sub-toggles
• Flow — logs network flow records (duration, byte counts, protocol)
• Stats — logs Suricata engine statistics (capture counters, decoder stats, memory usage)

Community ID — makes the community-id field configurable via the GUI (was hardcoded to false). Community ID is a standardised flow hash that enables cross-tool correlation between Suricata, Zeek, and other network security tools.

Changes

File	Change
IDS.xml	Add dns, flow, stats, communityId fields under eveLog; bump version 1.1.2 → 1.1.3
suricata.yaml	Add conditional Jinja2 blocks for new EVE types; make community-id configurable
generalSettings.xml	Add 6 new form fields under Advanced toggle
M1_1_3.php	No-op migration — new fields use model defaults

Motivation

SIEM integrations (Wazuh, Elastic, Splunk) benefit from richer EVE output beyond alerts. DNS logging enables threat hunting (tunneling, DGA detection), flow records provide network visibility, and stats enable performance monitoring. Community ID is increasingly expected by correlation tools.

The existing custom.yaml escape hatch cannot be used for this because Suricata's YAML merge fully overrides the outputs key rather than merging lists, so any custom.yaml approach would lose the default alert/anomaly/drop/ssh types.

This was originally raised in #2038 (2018, closed as timeout). PR #7775 solved it for HTTP and TLS — this PR extends the same pattern to the remaining commonly-requested types.

Testing

Verified on OPNsense 26.1.6 / Suricata 8.0.4:

• Template renders correct YAML with all combinations of toggles enabled/disabled
• New model fields accessible via the API (/api/ids/settings/get)
• Migration runs cleanly on upgrade from 1.1.2
• Live traffic test (dual 1Gbps WAN, ~1400 events captured):
  • flow: 1,357 events with community_id hashes
  • dns: 53 events with query/answer and community_id
  • stats: engine statistics logged to EVE
  • community_id present in 1,412/1,413 events (all network events; stats correctly excluded)
  • Existing types (alert, anomaly, drop, ssh) unaffected