docs: say which distribution a bare pcap module reference means #1948

pcap is written as a bare literal at most of its mentions, mostly in pcapkit/foundation/engines/{pcap_ct,pypcap,_pcap_backend}.py, plus extraction.py, the engines pages, index.rst and ext.rst. Both PyPCAP and pcap-ct install that same top-level pcap module. The docs say so in one place, docs/source/pcapkit/foundation/engines/3rdparty.rst:188, and a reader meeting a bare pcap elsewhere cannot tell which distribution it means.

A literal footnote does not fit: one defined in rst_epilog is appended to every page and warns as unreferenced wherever it goes unused. Two options:

1. A label and a substitution. Add .. _pcap-module: above the note at 3rdparty.rst:188, and write each mention as |pcap|_ (or :ref:`pcap <pcap-module>`), following docs: link inventory-less packages through rst_epilog substitutions (#1936) #1939's epilog pattern. Every mention then links to the one explanation.
2. A glossary term. Add a pcap entry to a glossary that names both distributions, and write each mention as :term:`pcap`. Each mention links to the glossary entry, so it reads like option 1 but adds a glossary page.

I'd take option 1: it reuses an existing mechanism and adds no new page. Mentions that name a distribution (pip install pypcap, the PyPCAP/PCAP_CT extras) stay as they are.