Analyze mode should support same (or similar) features as regular pipeline.

The current analyze mode is a replacement of the previous **tracee-rules** binary but misses many new features developed since then.

It needs to support **at least** a few things, such as:

- access to process tree information through data sources
- access to container enrichment info through data sources

For the data source to be available to the analyze mode, some steps being taken during the pipe line stages will have to be disabled (like realtime procfs access) and the data source might have to be serialized in a way it can be consumed later (for example).