tracee: add analyze cmd

[josedonizetti]

1. Explain what the PR does

Fix #2736

Adds analyze subcommand. The subcommand only accepts json as input, and only output json.

2. Explain how to test it

tracee --filter event=ptrace --output=json:events.json

tracee analyze events.json
tracee analyze --event=anti_debugging events.json
tracee analyze --event=dropped_executable events.json

3. Other comments

This is marked as EXPERIMENT, because the implementation will later change to support datasources. For now this is equivalent to tracee-rules.

[rafaeldtinoco]

LGTM.

NOTE: I think its ok to have it already included as experimental in v0.16.0 release as its orthogonal to any other code and couldn't cause any harm.

[NDStrahilevitz]

We should add a warning not to rely on data sources when running tracee analyze for now, just to cover that edge case until we resolve it.

[josedonizetti]

We should add a warning not to rely on data sources when running tracee analyze for now, just to cover that edge case until we resolve it.

That makes sense, as it is marked as experimental I expected people to know it will not support everything, but the warning will also help. I'll add it today!