fix: derived event not triggering if base filtered

[josedonizetti]

1. Explain what the PR does

Fix #3279

The bug happens because we pass a different event to matchPolicies inside the for, instead of passing the event that goes down the pipeline, so the logic of changing the bitmap is lost, because it happened on different events.

2. Explain how to test it

name: pol1
description: general policy
scope:
  - global
defaultActions: 
  - log
rules:
  - event: cgroup_mkdir
    filters:
      - args.cgroup_path!=/system.slice*
  - event: container_create

./dist/tracee -p policy.yaml

docker run ubuntu:latest ls

The container_created should be triggered but not the cgroup_mkdir.

3. Other comments

[yanivagman]

nice catch!
Please cherry-pick to v0.16.0 branch as well

[geyslan]

Good catch.

What about to remove the copied var usage above (derivative) and make all accesses via index to avoid further errors like that?

				for i := range derivatives {
					// Skip events that dont work with filtering due to missing types being handled.
					// https://github.com/aquasecurity/tracee/issues/2486
switch events.ID(derivatives[i].EventID) {

[yanivagman]

Good idea. This will also avoid the extra copy of creating derivative instance in the loop

[geyslan]

Good catch.

What about to remove the copied var usage above (derivative) and make all accesses via index to avoid further errors like that?

				for i := range derivatives {
					// Skip events that dont work with filtering due to missing types being handled.
					// https://github.com/aquasecurity/tracee/issues/2486
switch events.ID(derivatives[i].EventID) {

And the code suggestion was just to get us on the same page. Please be my guest on code style or naming, nits, anything 😄.

[josedonizetti]

@geyslan can you review the change pls?