RFE: execsnoop should track usermode helpers too

The kernel runs usermode helpers sometimes.

For example:

http://man7.org/linux/man-pages/man5/core.5.html

> Since kernel 2.6.19, Linux supports an alternate syntax for the
> /proc/sys/kernel/core_pattern file. If the first character of this
> file is a pipe symbol (|), then the remainder of the line is
> interpreted as a user-space program to be executed.

https://www.kernel.org/doc/Documentation/cgroup-v1/cgroups.txt

> If the notify_on_release flag is enabled (1) in a cgroup, then
> whenever the last task in the cgroup leaves (exits or attaches to
> some other cgroup) and the last child cgroup of that cgroup
> is removed, then the kernel runs the command specified by the contents
> of the "release_agent" file in that hierarchy's root directory,
> supplying the pathname (relative to the mount point of the cgroup
> file system) of the abandoned cgroup.

`execsnoop` doesn't track these `exec`s:

``` sh
$ cat /sys/fs/cgroup/systemd/release_agent
/usr/lib/systemd/systemd-cgroups-agent

$ cat /proc/sys/kernel/core_pattern
|/usr/lib/systemd/systemd-coredump %p %u %g %s %t %e
```

``` sh
$ systemd-run --user date

$ sh -c 'kill -ABRT $$'
Aborted (core dumped)
```

``` sh
$ sudo /usr/share/bcc/tools/execsnoop
PCOMM PID PPID RET ARGS
systemd-run 503 432 0 /usr/bin/systemd-run --user date
systemd-run 504 503 -2 /usr/bin/pkttyagent --notify-fd 5 --fallback
date 505 425 0 /usr/bin/date
sh 507 432 0 /usr/bin/sh -c kill -ABRT $$
systemd-coredum 509 1 0 /usr/lib/systemd/systemd-coredump
```

But

```
$ sudo stap -v -e 'probe kernel.function("do_execve").return { printf("%d %s exec %s\n", ppid(), pexecname(), cmdline_str()) }'
...
2 kthreadd exec /usr/lib/systemd/systemd-cgroups-agent /user.slice/user-1001.slice/user@1001.service/run-505.service
2 kthreadd exec /usr/lib/systemd/systemd-coredump 507 1001 1001 6 1465432051 sh
^C
```

/cc @brendangregg