Support stateful filtering for event buffers

[gianlucaborello]

Right now if we do

sysdig evt.buffer contains 'www.google.com'

We get just the specific events that contain the specified token.
It would be nice if this was stateful per-fd (maybe with a different filtering field?), like it already happens for paths, connections, etc., so that sysdig could be used in a "follow conversation"-like mode.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.