Better handling for encapsulated protocols

[thearossman]

L2 encapsulation: By requiring only Ethernet (and not checking for other protocols), Retina misses any WiFi traffic that is still 802.11-encapsulated.

L4 encapusulation: We see on the network some UDP-encapsulated TCP protocols (e.g., UDP -> ... -> TCP -> TLS). There isn't much of this, but encapsulation should ideally be examined at least one layer in.

Application-layer encapsulation is something to consider as well. For example, we see some TLS-in-HTTP (weird??) that's missed by the TLS parser.

Note: this isn't a suggestion to support more protocols (e.g., GENEVE).