Filter out and/or put on different track uretprobes syscall on moden kernels

uretprobes can be very confusing because it can cause tearing similar to the write syscall + atrace becuase it both creates a real slice event *and* the syscall also appears on the thread track.

We should either filter out uretprobes *or* we should mark it similar to write syscalls and put it on a differen track.

Start by locating the code that handles uretprobes syscall events and compare it with the existing write-syscall handling. Reproduce the duplicate thread-track and slice behavior, then implement the agreed filtering or separate-track behavior and verify that the tearing no longer occurs.

Written by the indexing model from the issue text.