Fix(events): don't remove fork excess args

[rscampos]

Part of #3520

1. Explain what the PR does

05ffffb Fix(events): don't remove fork excess args

Stop removing arguments from the `sched_process_fork` event.
This is removing an edge case making it easier to use the event.
It also makes it easier to reproducing the process tree.

The real parent process variable name 'up_parent_xxx' has been
renamed to 'parent_process_xxx'.

Co-authored-by: Alon Zivony <alon.zivony@aquasec.com>

2. Explain how to test it

3. Other comments

Credits to @AlonZivony, who did the work.

[rscampos]

@yanivagman , if I understood correctly from this comment (09f4685#r1660126189), the ideia is to replace the following to parent_process_xxx instead of up_parent_xxx in the core.go?

tracee/pkg/events/core.go

Lines 11175 to 11179 in 3cab205

	{Type: "int", Name: "up_parent_tid"},
	{Type: "int", Name: "up_parent_ns_tid"},
	{Type: "int", Name: "up_parent_pid"},
	{Type: "int", Name: "up_parent_ns_pid"},
	{Type: "unsigned long", Name: "up_parent_start_time"},

But this way won't be confused with:

tracee/pkg/events/core.go

Lines 11162 to 11166 in 3cab205

	{Type: "int", Name: "parent_tid"},
	{Type: "int", Name: "parent_ns_tid"},
	{Type: "int", Name: "parent_pid"},
	{Type: "int", Name: "parent_ns_pid"},
	{Type: "unsigned long", Name: "parent_start_time"},

If it's the case, should we try something different like ancestor_xxx?

[yanivagman]

@yanivagman , if I understood correctly from this comment (09f4685#r1660126189), the ideia is to replace the following to parent_process_xxx instead of up_parent_xxx in the core.go?

tracee/pkg/events/core.go

Lines 11175 to 11179 in 3cab205

	{Type: "int", Name: "up_parent_tid"},
	{Type: "int", Name: "up_parent_ns_tid"},
	{Type: "int", Name: "up_parent_pid"},
	{Type: "int", Name: "up_parent_ns_pid"},
	{Type: "unsigned long", Name: "up_parent_start_time"},

But this way won't be confused with:

tracee/pkg/events/core.go

Lines 11162 to 11166 in 3cab205

	{Type: "int", Name: "parent_tid"},
	{Type: "int", Name: "parent_ns_tid"},
	{Type: "int", Name: "parent_pid"},
	{Type: "int", Name: "parent_ns_pid"},
	{Type: "unsigned long", Name: "parent_start_time"},

If it's the case, should we try something different like ancestor_xxx?

I agree that it is confusing.
I think that if we will have parent_xxx and ancestor_xxx it will also be confusing.
It would be probably best to rename both so we will have parent_process_xxx and parent_task_xxx (which can also refer to a thread), but that may break existing signatures. For now, I think we can go with parent_process_xxx and keep parent_xxx as is, in the future we may break the other fields by introducing a new version of the event. WDYT?

[rscampos]

Think we can use parent_process_xxx for now and in the future we also rename the other field to parent_task_xxx to be less confusing.

[yanivagman]

LGTM