Truncate packet length for offline captures based on BPF return value

[Astolfi]

Seems related to this ticket:

https://github.com/the-tcpdump-group/libpcap/issues/438

[infrastation]

Fixes #438. Needs a trivial rebase because since commit 1131a7c the check uses pcap_filter() instead of bpf_filter().

[guyharris]

Any particular reason not to handle #438 by doing the truncation in the dump routine, i.e. just adding

/* Truncate packet to a maximum of 64 bytes */
if (pkt_hdr->caplen > 64)
    pkt_hdr->capen = 64;

to dump_packet() before the call to pcap_dump(). This requires no changes to libpcap.