enable MAC addresses in suricata events

[mmguero]

We should enable MAC addresses in suricata events. currently ethernet-layer header information is not included.

[mmguero]

macs come in the ether field as illustrated:

{
  "timestamp": "2026-01-22T15:21:09.914931+0000",
  "flow_id": 1349808827436686,
  "in_iface": "enp0s25",
  "event_type": "alert",
  "src_ip": "10.9.0.215",
  "src_port": 44580,
  "dest_ip": "3.165.160.10",
  "dest_port": 22,
  "proto": "TCP",
  "pkt_src": "wire/pcap",
  "ether": {
    "src_mac": "d8:9e:f3:07:c5:1f",
    "dest_mac": "3c:fd:fe:e9:df:40"
  },
  "community_id": "1:71yG+kORTA5bWFlPOymx2dKf3Ko=",
  "alert": {
    "action": "allowed",
    "gid": 1,
    "signature_id": 2003068,
    "rev": 7,
    "signature": "ET SCAN Potential SSH Scan OUTBOUND",
    "category": "Attempted Information Leak",
    "severity": 2,
    "metadata": {
      "confidence": [
        "Medium"
      ],
      "created_at": [
        "2010_07_30"
      ],
      "signature_severity": [
        "Informational"
      ],
      "updated_at": [
        "2019_07_26"
      ]
    }
  },
  "direction": "to_server",
  "flow": {
    "pkts_toserver": 2,
    "pkts_toclient": 0,
    "bytes_toserver": 148,
    "bytes_toclient": 0,
    "start": "2026-01-22T15:21:08.904100+0000",
    "src_ip": "10.9.0.215",
    "dest_ip": "3.165.160.10",
    "src_port": 44580,
    "dest_port": 22
  }
}

[mmguero]