Fix JA4+ fields not showing in Wireshark custom columns

[vlvkobal]

Fixes #269

Summary

This PR fixes JA4+ fields not appearing in Wireshark custom columns, tshark -T fields, and display filters.

The fingerprints were already computed correctly and shown in the Packet Details pane, but the same fields could be empty when accessed through non-visible packet trees used by columns and field extraction.

What was wrong

The JA4+ plugin is a post-dissector. It computes fingerprints, caches them, and re-adds them to the packet tree on later dissection passes.

When replaying cached values, the plugin wraps them in a ja4 subtree. In Wireshark’s visible packet tree, used by the Packet Details pane, that wrapper is a normal real node. But for custom columns, -T fields, and display filters, Wireshark uses a stripped-down non-visible tree where unreferenced protocol nodes can be represented as fake placeholders.

The old code treated a fake ja4 wrapper as a hard failure, so it returned before adding the actual JA4+ leaf fields, leaving custom columns and field extraction empty.

Fix

The replay path now keeps going when the ja4 wrapper is fake. The referenced JA4+ leaf fields, such as ja4.ja4s, are still materialized by Wireshark and can be used by custom columns, -T fields, and display filters.

The change also falls back to the root tree if the expected host protocol subtree cannot be found in a non-visible tree.

Tests

Added regression coverage for the broken paths:

• JA4+ custom columns without -Y ja4
• tshark -T fields -e ja4.<field> without -Y ja4

[vlvkobal]

@Boolean263 could you please take a look and test this?

Do you think this is safe to merge?

[Boolean263]

It seems good to me!

[vlvkobal]

Thanks, David!