Add support of monitoring write attempts to RO mounted files (with event that isn't vulnerable to TOCTOU)

A user may want to monitor write attempts to files that are mounted as read only.

In my local environment, tracee-ebpf only reports the 'openat' event, which is vulnerable to TOCTOU.

Do note that this is different from when someone attempts to write to a file that he doesn't have enough permissions (ACL) to do so - in that case the security_file_open event does occur.

Start by tracing tracee-ebpf's current handling of the openat event and compare it with the security_file_open path mentioned in the issue. Determine how write attempts on read-only mounts can be reported without TOCTOU exposure while preserving the distinct ACL-denial behavior; done means the relevant event is emitted for read-only mounts and covered by appropriate tests.

Written by the indexing model from the issue text.