Improves flow handling and adds runtime stats APIs

Refactors TCP and UDP flow managers to enhance analyzer selection and flow binding accuracy, including O(1) UDP stream rebinding by 5-tuple.
Introduces runtime stats tracking for engine and ruleset operations, exposing new APIs for granular performance and error metrics.
Optimizes GeoMatcher with result caching and supports efficient geosite set matching, reducing redundant computation in ruleset expressions.

io/nfqueue.go

@@ -1,3 +1,6 @@
+//go:build linux
+// +build linux
+
 package io
 
 import (

io/nfqueue_stub.go

@@ -0,0 +1,43 @@
+//go:build !linux
+// +build !linux
+
+package io
+
+import (
+	"context"
+	"errors"
+	"net"
+)
+
+var errNFQueueUnsupported = errors.New("nfqueue packet io is only supported on linux")
+
+type NFQueuePacketIOConfig struct {
+	QueueSize    uint32
+	ReadBuffer   int
+	WriteBuffer  int
+	Local        bool
+	RST          bool
+	NumQueues    int
+	MaxPacketLen uint32
+}
+
+func NewNFQueuePacketIO(config NFQueuePacketIOConfig) (PacketIO, error) {
+	_ = config
+	return nil, errNFQueueUnsupported
+}
+
+func (*unsupportedPacketIO) Register(context.Context, PacketCallback) error {
+	return errNFQueueUnsupported
+}
+
+func (*unsupportedPacketIO) SetVerdict(Packet, Verdict, []byte) error {
+	return errNFQueueUnsupported
+}
+
+func (*unsupportedPacketIO) ProtectedDialContext(context.Context, string, string) (net.Conn, error) {
+	return nil, errNFQueueUnsupported
+}
+
+func (*unsupportedPacketIO) Close() error { return nil }
+
+type unsupportedPacketIO struct{}