perf: poison non-HTTP flows to avoid repeated parse-fail-clear cycles

[Zious11]

Summary

When the HTTP analyzer receives TCP data from non-HTTP streams (SMTP, MySQL, binary protocols), it attempts to parse, fails, clears the buffer, and repeats on every subsequent data chunk. This wastes CPU on captures with many non-HTTP TCP flows.

Proposed Fix

Add a poisoned: bool field to HttpFlowState. After the first parse error on a flow, set poisoned = true and skip all future data for that flow. Track a non_http_flows: u64 counter in the summary.

Context

Found in HTTP analyzer error handling review.