Support reading PCAP files that are still being written to

[awick]

Support a new command line option that tells capture to process pcap files that are still open for writing. This will be useful with suricata 7 and other tools that write out large pcaps we want to process as they are being written to.

This will probably require scheme mode so we have direct access, which means we need to add monitor mode to scheme. Then when the file is closed move to the next file?

I'm not sure this is even possible