Suricata

A user can enable filestore output in eve as well as the dedicated file-store section. Some options are not recognized in the eve output section, like `write-fileinfo` or `dir`, but others like `force-filestore` are.

So for example, if a user did enable file-store and did set `force-filestore` to `false` but also enables the `eve` output section for files and adds `force-filestore: true` the force of the filestore is actually applied. This could be confusing since some other values have no real impact. Another option that is recognized and "merged" is `force-hash` so you could define `md5` in file-store and `sha1` in eve output and end up with both being enabled.

If we want to keep it like that, we could just update the documentation, but we should also decide why `write-fileinfo` has no impact in eve but `force-filestore` has. Some warnings could be used as well.