Add HBO Max/Max streaming detection

[cmonroe]

Please sign (check) the below before submitting the Pull Request:

• I have signed the ntop Contributor License Agreement at https://github.com/ntop/legal/blob/main/individual-contributor-licence-agreement.md
• I have read the contributing guidelines at https://github.com/ntop/nDPI/blob/dev/CONTRIBUTING.md
• I have updated the documentation (in doc/) to reflect the changes made (if applicable)

Link to the related issue:

Describe changes:
Extend NDPI_PROTOCOL_HBO with the domains Warner Bros. Discovery's Max service now uses, so HBO Max video sessions are classified instead of falling back to generic TLS/QUIC:

• h264.io WBD video CDN - QUIC video streams
• max.com Max app - API and media hosts
• discomax.com shared WBD streaming API and image hosts

These domains are WBD-wide.. CNN, Discovery+ and TNT Sports streaming traffic using the same infrastructure is also reported as HBO. Direct cnn.com/cnn.net website traffic still maps to NDPI_PROTOCOL_CNN, since SNI matching takes precedence over certificate-SAN matching.

Add a small sample capture containing the QUIC video flow plus TLS/QUIC control flows, and its expected result.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[IvanNardi]

Thank you for your contributions.
I simply merged your pcap into an existing one. As a general rule, if the new traffic is only about a "domain match", I prefer to keep it into the existing pcaps/sitesX.pcap files

[cmonroe]

Thank you for your contributions. I simply merged your pcap into an existing one. As a general rule, if the new traffic is only about a "domain match", I prefer to keep it into the existing pcaps/sitesX.pcap files

Got it.. I was torn on this but it totally makes sense. I'll follow your recommendation for future PRs. Thank you!