Move event scope filter into the kernel

Event scope filter is currently running in userspace, but it should be straight forward to move it into the kernel since we can use the same logic we use today to compute our scopes in the kernel.
This can be done by having new bpf maps like the current existing filters maps, with the difference that the key will be now composed of the event id and the field we are looking for.
A potential problem to this move can be instruction limit, and to solve this we might need to add another tail call.