Incorrect expected behavior of BPF_MAP_TYPE_LRU_HASH

According to the documentation for eBPF hash maps (https://docs.kernel.org/bpf/map_hash.html), an LRU hash map is expected to evict the least recently used item when attempting to insert an element when the map is full.

Despite this description, the implementation for the LRU hash map behaves in a way that causes maps with a small number of max entries to behave unexpectedly. See https://stackoverflow.com/questions/75882443/elements-incorrectly-evicted-from-ebpf-lru-hash-map for an example and discussion.

Tracee uses a few small capacity LRU hash maps (`io_file_path_cache_map`, `elf_files_map`, `recent_deleted_module_map`). They should be reviewed to make sure that they don't rely on incorrect assumptions about the behavior of the LRU map.

Start with the eBPF hash-map documentation and the linked Stack Overflow example to understand the reported eviction behavior. Review Tracee's io_file_path_cache_map, elf_files_map, and recent_deleted_module_map for assumptions about small-capacity LRU maps. Done means documenting or correcting any affected assumptions and verifying the maps behave as intended.

Written by the indexing model from the issue text.