filters: add container=started filter with eBPF support

[yanivagman]

Add filtering for containers by started state (post-entrypoint execution).

• Add ContStartedFilter to Policy and eBPF config
• Check CONTAINER_STARTED_FLAG in eBPF filtering
• Parse 'container=started' scope filter
• Update tests (removed container=init, now only container=started)

Note: container!=started not supported due to race conditions with early container event recognition.

[Copilot]

Pull Request Overview

This PR adds support for filtering containers by their started state using a new container=started filter. The feature enables filtering for containers that have completed their initialization phase and begun executing their main entrypoint.

• Add ContStartedFilter to Policy struct with corresponding eBPF configuration
• Implement parsing logic for container=started scope filter syntax
• Add eBPF filtering logic that checks the CONTAINER_STARTED_FLAG
• Update tests to cover the new container state filtering functionality

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
pkg/policy/policy.go	Adds ContStartedFilter field to Policy struct and updates related methods
pkg/policy/ebpf.go	Adds eBPF configuration fields for container started filter
pkg/filters/scope_test.go	Adds comprehensive tests for container=started filtering logic
pkg/filters/scope.go	Implements parsing and filtering logic for container=started syntax
pkg/ebpf/c/types.h	Adds eBPF data structure fields for container started filter
pkg/ebpf/c/common/filtering.h	Implements eBPF filtering logic using CONTAINER_STARTED_FLAG
pkg/cmd/flags/policy.go	Adds command-line parsing support for container=started flag

[codecov]

Codecov Report

❌ Patch coverage is 54.05405% with 17 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@e4492f4). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
pkg/cmd/flags/policy.go	0.00%	8 Missing ⚠️
pkg/policy/ebpf.go	0.00%	6 Missing ⚠️
pkg/filters/scope.go	84.21%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5011   +/-   ##
=======================================
  Coverage        ?   29.89%           
=======================================
  Files           ?      234           
  Lines           ?    26213           
  Branches        ?        0           
=======================================
  Hits            ?     7836           
  Misses          ?    17839           
  Partials        ?      538           

Flag	Coverage Δ
unit	29.89% <54.05%> (?)

Files with missing lines	Coverage Δ
pkg/policy/policy.go	94.64% <100.00%> (ø)
pkg/filters/scope.go	57.57% <84.21%> (ø)
pkg/policy/ebpf.go	0.00% <0.00%> (ø)
pkg/cmd/flags/policy.go	66.91% <0.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.