tracee-rules help text and UX needs improvement

[grantseltzer]

There are some things confusing about the tracee-rules help text:

1. --rules help says 'select which rules to load'. It should be made clear that this is selection from the output of --list.
2. --rules-dir says 'directory where to search for rules'. It should be made clear how the files in this directory are selected. Is this only rego files? or Go plugins?

• Will specifying --rules-dir add the added files to the output of --list?

These are more about UX then about the help text itself:

1. If no flag or argument is passed, tracee-rules exits silently. It should print help text or at least direction to specify the --help text.
2. If --tracee-file is only looking for gob files, would it be more clear to name it --gob-file?
3. We have a flag (--stdin-as) which reads JSON from standard input. We also have a flag for reading gob from any file (including stdin). I propose the following:
   • There should be a --input-format flag where the user can specify json or gob
   • There should be a --input-file flag where the user can specify a file (including stdin)

[itaysk]

thanks @grantseltzer , good comments.

regarding the last part about the input flag, I think we should align with tracee-ebpf's UX.
perhaps something like:

--input-tracee file:/path/to/file
--input-tracee option:{eot}
--input-tracee format:gob/json 

stdin can be given as a file (like in the readme) or we can create an alias for it

[grantseltzer]

I like this, and agreed on having an alias for stdin. I can work on this today.

[grantseltzer]

reference issue: #499