What does this PR do?

This PR tackles 5 things:

• Improves our pid <---> flow mapping in kernel space so that we more accurately attribute each network packet to the correct process. Some of the improvements require new eBPF features (like the BPF_MAP_TYPE_SK_STORAGE map type) and are therefore gated by the running kernel version (TL;DR kernel 5.11+)
• Introduces logic to monitor, aggregate and periodically flush network flows back to user space for further processing. This requires some new eBPF features and is therefore gated by the running kernel version (TL;DR kernel 5.13+)
• Introduces a new event type called network_flow_monitor to send network flows to user space. This event exposes the full 5 tuple, along with network telemetry like packet count and data size.
• Inserts network_flow_monitor events in activity dumps for further processing.
• Makes some clean up in various parts of the agent, such as: improve our activity dump graphs generation to make them more readable, improve how we organize our kernel space network code, improve our accessor generation logic for iterators.

2 new agent configuration parameters were added:

• event_monitoring_config.network.flow_monitor.enabled: controls if the network flow monitor should be enabled (when the kernel is recent enough to run it).
• event_monitoring_config.network.flow_monitor.period: controls how often flows should be flushed to user space for long running processes.

Motivation

This PR generates the events we'll use to address 2 use cases in upcoming PRs:

• We want to enrich the context of our events with network telemetry.
• We want to detect network scanners and more specifically (for now) when a process on a host monitored by CWS attempts to scan another machine (for example, with lateral mouvement in mind).

This PR is only a first step towards those 2 goals, and provides a way to continuously monitor network activity and stream it back to user space with performance in mind. Upcoming PRs will take care of the rest !

Describe how you validated your changes

Testing this feature in activity dumps

First, turn on the feature with:

event_monitoring_config:
  network:
    flow_monitor:
      enabled: true

runtime_security_config:
  activity_dump:
    enabled: true
    local_storage:
      formats:
        - ...
        - dot
    traced_event_types:
      - ...
      - network_flow_monitor

Start the agent. Once it's running, start a new container and generate some network activity. Stop the dump and open the output .dot file. You should see network flows in the graph. Note that only the dot export contain the flows for now

Testing this feature with a rule

First, turn on the feature with:

event_monitoring_config:
  network:
    flow_monitor:
      enabled: true

You can use a rule like:

network_flow_monitor.flows.length > 0

Start the agent. Once it's running, generate some network activity. You should start seeing events.