fix(userspace): check the supported number of online CPUs with modern bpf

[Andreagit97]

What type of PR is this?

/kind bug

/kind cleanup

Any specific area of the project related to this PR?

/area engine

/area tests

What this PR does / why we need it:

Right now the modern bpf config cpus_for_each_syscall_buffer can be used only with a number of CPUs lower than the actual number of online CPUs in the system. The real fix should be to handle this situation in a better way directly in the modern bpf engine but since we are short in time this patch on the fly in Falco seems the right way to go!

Example:

• in the system, there is only 1 online CPU
• by default, the modern bpf opens one buffer every 2 CPUs
• in the modern bpf engine there is a check that compares the required CPUs with the online ones: so in this case, 2>1 -> the modern bpf engine will generate an error
• here we have seen exactly what I've just described: https://kubernetes.slack.com/archives/CMWH3EH32/p1684561641886179

Fix:

If the number of required CPUs exceeds the online CPUs number, we set the required number to the number of online CPU

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

fix(userspace): check the supported number of online CPUs with modern bpf

[FedeDP]

/approve

[poiana]

LGTM label has been added.

Git tree hash: 2b805f788d09d7298791997021339fbe9fb74e40

[jasondellaluce]

/approve

/milestone 0.35.0

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, jasondellaluce

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97,FedeDP,jasondellaluce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment