Add check_syscall_source event

[oshaked1]

1. Explain what the PR does

Add a new event, check_syscall_source, which reports invocations of syscalls from unusual code locations (stack, heap and anonymous VMAs).
It is implemented using a new tail call placed in sys_enter, which triggers the analysis only for syscalls that were selected using a filter, e.g. tracee -e check_syscall_source.args.syscall=open,openat.
Closes #4002

2. Explain how to test it

The easiest way to test the event is using the included tester program, which executes a small shellcode that invokes the exit syscall from the stack/heap/anonymous VMA according to the command line argument. Note that it must be compiled with -z execstack to be able to run the shellcode from the stack.

Another way of testing the event (for arbitrary syscalls) is by packing a program:

# compile statically, so libc syscall wrappers are not loaded to separate (legitimate) code areas
gcc -o my_program -static my_program.c

# pack the program
upx -o my_program_upx my_program

# run it
./my_program_upx

[oshaked1]

The ebpf code for this event contains a call to the bpf_find_vma helper if it exists (an alternative logic is implemented for older kernels where the helper doesn't exist).

Because this helper uses a callback function or in verifier terms a "bpf-to-bpf call", this program cannot be combined with tail calls (which it uses) on some older kernels, even though the helper call would not be called on those kernels.

As a result, this event must be split into 2 separate programs that will be loaded conditionally based on kernel version. Currently no such mechanism exists, but is in the works. When such a mechanism will be implemented this event will be split into 2 programs so it can be merged.

EDIT

The logic for newer kernels which uses the bpf_find_vma call was removed, so the event will now only work on kernel version < 6.1. When conditional program loading will be implemented, the logic for newer kernels will be added as a separate program.