Add Wireshark display filter support

Description

TCP Viewer has a visual filter builder, but many people already know Wireshark display filters and use them every day.

Add a Wireshark mode to the packet filter panel. A user should be able to type or paste a Wireshark display filter and apply it without exporting the capture or opening another app.

The filter should use TCP Viewer's embedded Wireshark engine. This keeps the syntax and packet results close to Wireshark. The app should check the expression before applying it. If it is invalid, show a useful message, highlight the part that needs fixing, and keep the last working result on screen.

The current Builder mode should stay available for people who prefer the visual controls.

What the filter works with

• Protocol names such as tcp, udp, dns, http, tls, icmp, arp, and ipv6.
• Protocol fields such as tcp.port == 443, ip.addr == 192.168.1.10, and http.request.method == "GET".
• TLS fields, including server names such as tls.handshake.extensions_server_name.
• Logic with and, or, not, and parentheses.
• Text and payload checks with contains and matches.
• Sets, ranges, field slices, and common Wireshark helper functions supported by the embedded Wireshark version.
• Wireshark columns such as _ws.col.protocol and _ws.col.info.
• Imported .pcap and .pcapng files.
• Running and stopped live captures.
• Existing quick filters and source-list selections.
• Saved custom filters and TCP Viewer session files, so the expression can be reused later.

Example

tcp.port == 443 and tls.handshake.extensions_server_name contains "example.com"

This should show HTTPS packets whose TLS server name contains example.com.

Related implementation: #95