feat: use BPF_MAP_TYPE_INODE_STORAGE for ignored cache

[Molter73]

Description

Whenever we find a file that we should ignore based on its path, we can attach a byte to its inode so that we will know on future accesses that the file should be ignored before we do any sort of processing on our hooks. Because the information is attached to the inode itself, when the inode is removed the storage will be cleaned up on its own. A re-used pointer to an inode should also not cause false hits, since this is specific to the inode we attached to and should go away when the inode is freed.

Checklist

• Investigated and inspected CI test results
• Updated documentation accordingly

Automated testing

• Added unit tests
• Added integration tests
• Added regression tests

If any of these don't apply, please comment below.

Testing Performed

• Manually tested with some print statements that hits are happening.

[Molter73]

After some more testing this approach may yield wrong results with hardlinks, causing a monitored file to stop reporting events if accessed via a hardlink on a path that is not monitored. Example:

• Monitor /etc/monitored
• touch /etc/monitored/something will trigger an event.
• Create a hardlink with ln /etc/monitored/something /etc/something
• touch /etc/something doesn't generate an event.
• touch /etc/monitored/something no longer triggers events.

We might be able to use struct dentry or struct path as a key to a LRU map instead.