eBPF gatekeeper support

### Describe the feature you'd like supported

As noted in my ebpf summit talk https://ebpf.io/summit-2022 on "Signed eBPF Programs: A Cross-Platform Analysis", the gatekeeper concept would apply to Windows.

### Proposed solution

A gatekeeper hook would ideally need to run prior to relocation, which today is done in ebpfsvc. That means either a gatekeeper needs to run in ebpfsvc or else make a kernel call to run the gatekeeper in the kernel execution context, prior to submitting the program to the kernel.

### Additional context

_No response_

Start by tracing the existing program submission and relocation path through ebpfsvc and the kernel-facing entry points. Define where a gatekeeper can run before relocation and document or implement the selected path, with coverage showing that gatekeeper processing occurs before the program is submitted to the kernel.

Written by the indexing model from the issue text.