Move c$service_violation to deprecated-dpd-log.zeek

This moves c$service_violation to the deprecated-dpd-log policy script.

This is the only script in the distribution that uses the field, and it
is unlikely to be used externally. It is also responsible for a
significant amount of memory use by itself.

This also restores the field being populated, which was broken in
GH-4362

testing/btest/Baseline/coverage.record-fields/out.bare

@@ -29,7 +29,6 @@ connection {
   * resp: record endpoint, log=F, optional=F
       endpoint { ... }
   * service: set[string], log=F, optional=F
-  * service_violation: set[string], log=F, optional=T
   * start_time: time, log=F, optional=F
   * tunnel: vector of record Tunnel::EncapsulatingConn, log=F, optional=T
       Tunnel::EncapsulatingConn {