fix(events): hidden_kernel_module - change history scan behaviour

[OriGlassman]

1. Explain what the PR does

fix(events): hidden_kernel_module - change history scan behaviour

The MAX_NUM_MODULES was recently decreased from 600 to 450 and is anyway relatively small.
In case there are more modules to iterate on than the number of the
iterations done, it will report the rest as false positives.
To mitigate that, an LRU holds the suspected events and waits until the
scan finishes: if the scan finished successfully, sends the events and
otherwise deletes them.

This was introduced in kernels 6.5 where the mod_tree contains 3x nodes
as before, and 450 iterations are not enough if there are about 450/3
modules loaded in the system.

When it's possible to use bpf_loop (currently RHEL verifier fails if the
helper exists in the code; specific program loading might solve it),
this patch needs to be reverted and the patch that uses bpf_loop needs
to be used instead.

Close #4021

2. Explain how to test it

./tracee -e=hidden_kernel_module

3. Other comments

[yanivagman]

LGTM