add IP blacklist alerting feature

[satta]

This PR adds a new processing handler that, not unlike the Bloom filter handler, emits alerts when source or destination IPs in any incoming event are within a list of CIDR ranges previously given to FEVER.

For instance, one could provide a list such as

10.0.0.0/24
35.190.247.0/24

which would cause any traffic from or to, say, 10.0.0.45 or 35.190.247.122 to generate an alert. The original contents of the EVE metadata item that caused the alert is attached inside the alert EVE, as it is done with traditional alerts generated by Suricata.

Here's what an alert would look like:

{
  "timestamp": "2018-12-12T15:45:02.503513+0100",
  "event_type": "alert",
  "src_ip": "10.0.0.45",
  "src_port": 29636,
  "dest_ip": "10.1.2.3",
  "dest_port": 80,
  "proto": "TCP",
  "alert": {
    "action": "allowed",
    "gid": 0,
    "rev": 0,
    "signature": "IP BLACKLIST Communication involving IP 10.0.0.45 in listed range 10.0.0.0/24",
    "category": "Potentially Bad Traffic",
    "severity": 3
  },
  "http": {
    "hostname": "foo.bar",
    "url":"\/",
    "http_user_agent":"curl\/7.52.1",
    "http_content_type":"text\/html",
    "http_method":"GET",
    "protocol":"HTTP\/1.1",
    "status":200,
    "length":894
  }
}

Ranges to alert on are held in a trie implemented by cidranger (https://github.com/yl2chen/cidranger) so lookups are fast enough to be done on both IPs in potentially high-volume input data selections.