GH-664: fix signature matching for payload-carrying SYN packets

Or more generally, signatures would not work correctly for any case
where the first TCP packet seen contained payload data, regardless of
its TCP flags.

testing/btest/Baseline/signatures.tcp-syn-with-payload/tcp-fast-open.out

@@ -0,0 +1 @@
+signature_match [orig_h=10.99.99.1, orig_p=55534/tcp, resp_h=10.99.99.45, resp_p=80/tcp] - payload of dst-port=80/tcp contains 'passwd'