feat: generate RPM packages for CentOS 7, Rocky Linux 8/9/10

- Update Dockerfile.package to build RPMs for multiple distributions
  using a unified fpm-based approach
- Add RPM maintainer scripts (postinst, prerm, postrm) for proper
  installation and service management
- Update ja4sentinel.spec for CentOS 7+ compatibility
- Add packaging/systemd/config.yml as default configuration
- Update test-rpm.sh to test installation on all 4 target distributions
- Fix CentOS 7 repository configuration (EOL - vault.centos.org)

Generated RPMs:
- el7: CentOS 7 (libpcap >= 1.4.0)
- el8: Rocky Linux 8 (libpcap >= 1.9.0)
- el9: Rocky Linux 9 (libpcap >= 1.9.0)
- el10: AlmaLinux 10 / Rocky Linux 10 (libpcap >= 1.9.0)

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

packaging/systemd/config.yml

@@ -1,35 +1,39 @@
-# JA4Sentinel Configuration
-# Default configuration file for ja4sentinel service
+# Default configuration file for ja4sentinel
+# This file is installed as /etc/ja4sentinel/config.yml.default
 
 core:
-  # Network interface to monitor (use 'ip link' to list available interfaces)
+  # Network interface to capture traffic from
+  # Will be overridden by JA4SENTINEL_INTERFACE env var if set
   interface: eth0
-  
+
   # TCP ports to monitor for TLS handshakes
   listen_ports:
     - 443
     - 8443
-  
-  # Optional BPF filter (leave empty for default port-based filter)
+
+  # Optional BPF filter (leave empty for auto-generated filter based on listen_ports)
   bpf_filter: ""
-  
-  # Timeout in seconds for TLS handshake extraction per flow
+
+  # Timeout in seconds for TLS handshake extraction (default: 30)
   flow_timeout_sec: 30
 
-# Output configuration - enable one or more outputs
+  # Buffer size for packet channel (default: 1000, increase for high-traffic environments)
+  packet_buffer_size: 1000
+
 outputs:
-  # Log to stdout (captured by journald)
+  # Output to stdout (JSON lines) - disabled by default for production
   - type: stdout
+    enabled: false
+    params: {}
+
+  # Output to file
+  - type: file
     enabled: true
-  
-  # Log to file (optional)
-  # - type: file
-  #   enabled: false
-  #   params:
-  #     path: /var/log/ja4sentinel/ja4.json
-  
-  # Log to UNIX socket (optional, for external processing)
-  # - type: unix_socket
-  #   enabled: false
-  #   params:
-  #     socket_path: /var/run/ja4sentinel/ja4.sock
+    params:
+      path: /var/log/ja4sentinel/ja4.log
+
+  # Output to UNIX socket (for systemd/journald or other consumers)
+  - type: unix_socket
+    enabled: true
+    params:
+      socket_path: /var/run/ja4sentinel.sock