Optimize init program

[yanivagman]

1. Explain what the PR does

perf: use lazy program data initialization

We currently initialize all task context related fields on the beginning
of our BPF programs. Reading all the relevant fields takes some CPU
cycles although these fields are not always used. In many cases, for
example when filters are applied, the event is not sent to userspace and
is just dropped without any side effects.

Reading only the essential fields and leaving all other fields
initialization to the submit stage will avoid wasting these cycles, and
will also allow us to perform some of the event enrichment in userspace
instead (not part of this PR).

To do this change, we have to remove the matched_policies which were
cached in task_info since we can't check if "context changed" anymore.
Considering that the average user will only use one or two scope filters
(e.g. container id or binary name), computing the scope on every run is
not a big overhead - running BPF statistics with and without the
change verified this is indeed the case, and with the change the
performance is even slightly better.

Although this change does not introduce a visible performance gain for
most of the events, it is clear for some other specific event that it
does. For example, the hidden_inode event which attach a program to the
filldir64 function has a 50% performance gain.

2. Explain how to test it

3. Other comments

[geyslan]

That's great!

I've done the first pass and did some questions.

[NDStrahilevitz]

I will run this full branch on my cluster before giving a +1. Had some questions too.

Have to note on the filldir64 case in particular: I believe the case there isn't this optimization in particular. Note that we have a quick terminating conditional based on a kprobe context argument (the inode_number == 0 check). We could have just as well moved it to the head of the function before the init,trace,submit function trio, and had just the same effect.

[geyslan]

It passed locally, I can't see why it failed when triggered by the action: https://github.com/aquasecurity/tracee/actions/runs/8360692120/job/22887161311.

Anyhoo, I'm gonna replay this test in Github.

[geyslan]

Great.

[NDStrahilevitz]

Performance test turned out good, let's merge.