Add container_start event and PID to existing_container

The existing_container event is useful to inform signatures and the user on the already running containers on a system before deploying tracee.

However, sometimes the launching PID of the container, the parent of all processes internal to it, is needed for application and security reasons. This information is not delivered with the existing_container event, nor with the current container_create event.

For existing containers, the PID can be gathered from the cgroup.procs file in the cgroup directory. For new containers, a container_start event will be added, tail called from sched_process_exec. This will also allow us to gather information on the container's privileges, environment variables, etc. from eBPF.