[Bug Report] Pid matching misfunctions when running dae inside a pid-namespaced container

### Checks

- [X] I have searched the existing issues
- [X] I have read the documentation
- [X] Is it your first time sumbitting an issue

### Current Behavior

Running dae inside a container with an independent pid namespace leads to infinite loop. This is because cgroup/* bpf programs record host pid while dae setup namespaced pid by `os.GetPid()`.

Likely it's not a bug, as I am not aware of any solution except:
1. we match process name instead of pid
2. we ditch the pid matching to be in favor of mark matching (to distinguish dae traffic)

Still, the general pid routing fails to work properly when inside a pid-namespaced container.

Not saying we must take care of this, just open an issue for record and awareness.

### Expected Behavior

_No response_

### Steps to Reproduce

1. Prepare the conf:

```
global {
tproxy_port: 12345
log_level: trace
wan_interface: auto
allow_insecure: false
}

node {
local: 'socks5://socks5:1080'
}

group {
proxy {
policy: min_moving_avg
}
}

routing {
fallback: proxy
}
```

2. Run dae inside a pid-namespaced container

```
# assume we have "dae" binary under pwd
docker run -td --name dae --privileged -v $(pwd):/host ubuntu:22.04 bash
docker exec dae mount bpffs -t bpf /sys/fs/bpf
docker exec dae mount -t debugfs none /sys/kernel/debug/
docker exec -it docker exec -it dae /host/dae run -c /host/conf.dae
```

3. dae gets stuck into infinite loop

### Environment

- **Dae version (use `dae --version`)**: dae version unstable-20231221.r627.84c8eeb
- **OS (e.g `cat /etc/os-release`)**: Ubuntu 22.04.3 LTS
- **Kernel (e.g. `uname -a`)**: Linux gray-Latitude-5530 6.2.0-39-generic #40~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Nov 16 10:53:04 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
- **Others**: None

### Anything else?

_No response_

Reproduce the issue with the listed Docker commands, then trace the cgroup/* BPF programs and the dae setup path using os.GetPid(). The issue names no files or tests and gives no expected behavior; first establish whether pid matching should be replaced or explicitly unsupported, then define completion criteria.

Written by the indexing model from the issue text.