refactor: Improve API used by ebpf programs

[yanivagman]

1. Explain what the PR does

As preparation for migrating event scope filters into the kernel and matching filters by event id, we now save the event id in the program_data_t structure during initialization instead of when submitting the event to userspace.

By knowing the event id during program init, we can also retrieve the bitmap of the policies that requested this event, removing the need to call should_submit() within the program.

Next, should_trace() is renamed to evaluate_context_filters() to better represent its function and accommodate potential future argument filters. This function considers both event submit bits and matched context filters. Its return value is now boolean to hide the internal policy matching mechanism, ensuring future-proofing against changes in bitmap size or implementation.

For programs with logic for multiple events, we introduce event_is_selected() to determine if the event is selected by any policies. We also add reset_event() to reset matched_policies and argument buffer for a new event id, and reset_event_args_buf() for cases where the same event is submitted multiple times from the same program, addressing a bug where submitting multiple events may yield incorrect matched_policies bitmap.

Additionally, policies_matched() is added to return the result of matched_policies.

2. Explain how to test it

3. Other comments

[geyslan]

I'll be on this today 👍🏼.

[geyslan]

LGTM, I put some doubts and suggestions.

[geyslan]

As this is the only point that reset_event can fail (and all callers return/abort when this returns false), shouldn't we anticipate its check in the beginning of the function?

[yanivagman]

Not sure I understand what you mean here

[geyslan]

I meant: only touch event fields if there actually is a config for that event, like:

statfunc bool reset_event(event_data_t *event, u32 event_id)
{
    // check first
    event_config_t *event_config = get_event_config(event_id, event->context.policies_version);
    if (event_config == NULL)
        return false;

    // reset if there's a config for it.
    event->context.eventid = event_id;
    reset_event_args_buf(event);
    event->config.submit_for_policies = ~0ULL;
    ...

[yanivagman]

I don't know about this change.
These fields not depend on the event config, and cost almost nothing (just simple assignments).
In case the caller don't check the return value, returning from reset_event after doing these 4 assignments makes the reset valid, and matched_policies is set to match all policies.