feat: include ancestors in process events

[t0x01]

Fixes 2420

Description

Reason: Option to include all ancestors of the process in process events can be very useful for observability and filtering purposes. E.g. to apply complex correlation rules later in data processing pipeline, or to filter out extra events.

Changes made:

• Read and set option enable-process-ancestors from the config file. Turn option enable-process-ancestors off by default.
• If option enable-process-ancestors is set, try to include ancestors (up to PID 1/PID 2) of the process beyond the immediate parent in process_exec, process_exit, process_uprobe, process_kprobe, process_lsm, process_tracepoint events in a respective protobuf message for the given process.
• If option enable-process-ancestors is set and there was an error when trying to include process' ancestors in the protobuf message, add the event to eventcache for reprocessing.
• When trying to reprocess events from eventcache, if option enable-process-ancestors is set and Ancestors is nil, try to include process' ancestors again.
• Implement a new export filter that can filter over ancestor binary names using RE2 regular expressions.
• Add a new test for the new export filter.
• Add information about new features to documentation.

[netlify]

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	558ee86
🔍 Latest deploy log	https://app.netlify.com/sites/tetragon/deploys/6707a122b8747a000801963b
😎 Deploy Preview	https://deploy-preview-2938--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[t0x01]

Hello.

Upd: found even more problems, converting back to draft for now.

[jrfastab]

I'll look shortly sorry was travelling and then catching up. Should be able to get to this today or tomorrow thanks!

[t0x01]

I think i misunderstood the purpose of both MsgProcessCleanupEventUnix and refcnt initially, so i no longer call RefInc / RefDec for ancestors. Sorry for that.

So now there seems to be no real reason to return []*ProcessInternal in GetAncestorProcessesInternal instead of []*tetragon.Process. And, if i change that, it will solve the double loop problem as well. But i'm not sure if i should actually do that, because returning []*ProcessInternal may be beneficial in the future for reasons i don't yet see.

And there is still inconsistency in the ancestors field's value across protobuf messages in api/v1/tetragon/tetragon.proto and vendor/github.com/cilium/tetragon/api/v1/tetragon/tetragon.proto. I'm still not sure how to properly handle that.

@jrfastab, may I ask you for a code review now? Sorry for the delay.