Add user_known_write_monitored_dir_conditions

[JPLachance]

Add a user_known_write_monitored_dir_conditions macro to allow custom conditions in the "Write below monitored dir" rule.

For example, with this macro, we can allow the root user to connect to BitBucket using SSH:

# Some applications allowed to write below monitored dir
- macro: user_known_write_monitored_dir_conditions
  condition: >
    fd.name startswith /root/.ssh and proc.cmdline="ssh hg@bitbucket.org hg -R some/repo serve --stdio"

falco-CLA-1.0-contributing-entity: Coveo Solutions Inc.
falco-CLA-1.0-signed-off-by: Jean-Philippe Lachance jplachance@coveo.com

[mstemm]

Thanks!