feat: Add qualifiers field to BPF enforcer custom rule interfaces

[Danny-Wei]

What this PR does

Extends the BPF enforcer’s custom rule interface with a qualifiers field across core rule types, enabling users to specify rule behavior modifiers (e.g., deny, audit)—aligning with AppArmor’s familiar syntax. This allows granular control over custom rule actions in EnhancedProtect mode, supporting use cases like rule testing and targeted audit-only monitoring.

Key Features Added

• Added optional Qualifiers []string field to 7 core BPF rule structs to define rule behavior:
  • FileRule (file/process access control)
  • Service / Pod / Destination (network egress targeting)
  • NetworkSocketRule (socket operation control)
  • PtraceRule (process tracing restrictions)
  • MountRule (filesystem mount control)
• Supported qualifiers values and behavior:
  • ["deny"]: Blocks matching behavior without auditing.
  • ["audit"]: Logs matching behavior without blocking (observation mode for the rule).
  • ["audit", "deny"]: Block and logs matching behavior.

Benefits

1. Granular Behavior Control: Users can tailor rules to audit first (before full denial) or target specific restrictions, reducing false positives.
2. Grayscale Rollouts: New custom rules can be tested in audit mode to validate coverage before switching to deny, minimizing operational risk.
3. Enforcer Consistency: Matches AppArmor’s modifier workflow, creating a unified experience across vArmor’s enforcers.

Related Issue

Fixes #248

Notes

The allow qualifier is not supported for now. The BPF enforcer’s Allow-by-Default model permits actions unless explicitly restricted via deny.