version tracee Event

[itaysk]

the way Tracee-eBPF writes events may change, which might break existing consumers. we should coordinate the format of the events via a version that will be determined by tracee-ebpf and consumed by tracee-rules (or other consumers)

[itaysk]

discussed offline and settled on:

1. aim to be backwards compatible when possible (only add new fields, don't change existing)
2. change tracee-ebpf to send only raw data (for argument values), and the consumer (tracee-rules or tracee-ebpf printer) will be able to present them differently. to support that, we will move "argPrinters" from Tracee to libbpfgo (Move argprinters from tracee-ebpf to libbpfgo #485)

we hope this approach will help us avoid incompatibility issues, so we won't need to version the tracee event

[yanivagman]

One point to remember about 2 is that the default behavior of running tracee-ebpf standalone should be still printing with the arg printers. We should let the user choose if he wants to print raw args by setting it in the --output flag