macos: es_process_file_events -- add support for open events, and for only triggering on file_paths

[sharvilshah]

Tested on:

• macOS 11 (Big Sur)
• macOS 12 (Monterey)
• macOS 13 (Ventura)

Test osquery.conf:

{
  "options": {
    "disable_events": "false",
    "verbose": "true",
    "disable_events": "false",
    "ephemeral": "true",
    "disable_endpointsecurity": "false",
    "disable_endpointsecurity_fim": "false",
    "es_fim_enable_open_events": "true"
  },
  "schedule": {
    "es_file_events": {
      "query": "SELECT * FROM es_process_file_events;",
      "interval": 20
    }
  },
  "file_paths": {
    "monitor": [
      "/Users/*/.aws/*",
      "/Users/*/.ssh/*",
      "/Users/*/.config/gcloud/*",
      "/Library/Keychains/*.keychain"
    ]
  },
  "exclude_paths": {
    "monitor": [
      "/Users/*/.ssh/id_ed25519.pub"
    ]
  }
}

[directionless]

Chatting in office hours, there was discussion of how the open events would work pre-13.

Consider the scenario where a site has a deployment across versions. They want this feature, but it's non-performant on v12. We think this failure case is more likely than someone who wants this new functionality on v12.

As such, we think this feature should not be enablable pre-13.