Add user_known_change_thread_namespace_binaries

[JPLachance]

Add the user_known_change_thread_namespace_binaries list to simplify the "Change thread namespace" rule tweaks.

This can be very useful to modify the "Change thread namespace" from the falco_rules.local.yaml file without copying the entire rule. I will use this new array to whitelist calico, our overlay network in our Kubernetes cluster, which was raising:

{
    "output": "15:18:23.416545428: Notice Namespace change (setns) by unexpected program (user=root command=calico  parent=calico k8s.pod=<NA> container=host)",
    "priority": "Notice",
    "rule": "Change thread namespace",
    "time": "2018-02-19T15:18:23.416545428Z",
    "output_fields": {
        "container.id": "host",
        "evt.time": 1519053503416545428,
        "k8s.pod.name": null,
        "proc.cmdline": "calico ",
        "proc.pname": "calico",
        "user.name": "root"
    }
}

[mstemm]

Thanks! I'll merge it.