quic: handle new Initial on reused flow

[jiangshaoqi]

Contribution style

• I have read the contributing guidelines.

Contribution agreement

• I have signed the Open Information Security Foundation contribution agreement.

Changes

• User Guide update (not applicable; no user-facing configuration changes)
• JSON schema update (not applicable; no logging schema changes)
• Public Redmine ticket: https://redmine.openinfosecfoundation.org/issues/8776

Link to ticket: https://redmine.openinfosecfoundation.org/issues/8776

Describe changes:

• Allow a valid new Client Initial on a reused UDP five-tuple to replace the previous QUIC Initial parsing state, so its ClientHello and SNI are inspected.
• Derive candidate Initial keys without replacing the active keys; reset the existing state only after the candidate packet decrypts and parses successfully.
• Preserve the active connection on invalid or unrelated Initial packets, and use the Initial DCID to distinguish candidates whose SCID is zero length.

This is a rebased replacement for #15979 and addresses its review feedback. The public reproducer and Suricata-Verify test are in OISF/suricata-verify#3324.

Validation:

• Rust formatting passed.
• Rust tests passed (621 library tests and 1 suricatactl test).
• The complete QUIC Suricata-Verify selection passed: 20 passed, 0 failed, and 1 version-dependent skip, including the five-tuple reuse test.

SV_REPO=
SV_BRANCH=OISF/suricata-verify#3324
SU_REPO=
SU_BRANCH=

[github-actions]

NOTE: This PR may contain new authors.