Support rr debugger (record-replay) by allowing the syscall `perf_event_open` in Gitpod workspaces

Is your feature request related to a problem? Please describe

Debugging software with rr in Gitpod currently doesn't work:

# Install rr
$ cd /tmp && wget https://github.com/rr-debugger/rr/releases/download/5.5.0/rr-5.5.0-Linux-$(uname -m).deb && sudo dpkg -i rr-5.5.0-Linux-$(uname -m).deb

# Try rr with any binary
$ cd - && rr record ./binary
rr needs /proc/sys/kernel/perf_event_paranoid <= 1, but it is 2.
Change it to 1, or use 'rr record -n' (slow).
Consider putting 'kernel.perf_event_paranoid = 1' in /etc/sysctl.d/10-rr.conf.
See 'man 8 sysctl', 'man 5 sysctl.d' (systemd systems)
and 'man 5 sysctl.conf' (non-systemd systems) for more details.

Initially reported by William Durand from Mozilla: https://twitter.com/couac/status/1521092130890031105

Describe the behaviour you'd like

I suspect this fails because Gitpod's seccomp profile disables the syscall perf_event_open by default.

I also believe that we could allow perf_event_open in Gitpod, provided there aren't any major security issues.

This would allow Gitpod users to benefit from the powerful and popular record-replay debugger rr.

Describe alternatives you've considered

Additional context

To work properly, rr needs:

• the CAP_SYS_PTRACE capability (already granted since https://github.com/gitpod-io/gitpod/issues/544)

... as well as a seccomp profile that allows:

• the ptrace syscall (I believe this is allowed by default in Linux kernels >= 4.8)
• the perf_event_open syscall (I believe this is disabled by default)
• and maybe the process_vm_writev syscall too (but let's focus on perf_event_open first)

Sources:

• https://github.com/rr-debugger/rr/wiki/Docker
• https://github.com/JanitorTechnology/janitor/pull/315#issuecomment-489658624

Start by locating Gitpod's workspace seccomp profile and reproducing the reported rr record ./binary failure. Review the linked rr requirements, especially perf_event_open, ptrace, and possibly process_vm_writev, then assess the security implications. Done means the required syscall is supported in a workspace and rr can record a binary successfully.