ROX-30714: use cgroup id for container id resolution

[Molter73]

Description

This approach is based on using the cgroup id of processes to resolve the container ID in userspace. In order to achieve this, a LRU BPF map is used to keep a mapping of cgroup id to cgroup "path", send the cgroup id as part of file events and parsing the container id by directly accessing the map from userspace. The LRU map is filled from userspace at startup and then kept up to date by a BPF program on the cgroup_attach_task tracepoint, inserting new cgroup ids as we find them.

The initial loading of the BPF map could be done with a BPF iterator instead, but we need to update to a newer (unreleased) version of aya that supports this type of program first. I also had some trouble getting the BPF iterator to attach correctly, so for now we stick the the userspace implementation.

Reading the map entries from the kernel directly might pose a performance penalty that we might not want to pay, if that is the case, we can consider caching the container IDs directly in userspace, but it would require a mechanism for cleaning it up and prevent it from blowing up over time.

Alternative implementation to #83.

Checklist

• Investigated and inspected CI test results
• Updated documentation accordingly

Automated testing

• Added unit tests
• Added integration tests
• Added regression tests

If any of these don't apply, please comment below.

Testing Performed

Run a short lived container with podman run --rm fedora:43 touch /etc/something while monitoring /etc and validate the container ID is properly caught.