Add support for bpf system call

Add support for bpf system call

Fixes: 388786 - Support bpf syscall in amd64 Linux
Add support for bpf() Linux-specific system call on amd64 platform. The
bpf() syscall is used to handle eBPF objects (programs and maps), and
can be used for a number of operations. It takes three arguments:

- "cmd" is an integer encoding a subcommand to run. Available subcommand
  include loading a new program, creating a map or updating its entries,
  retrieving information about an eBPF object, and may others.
- "attr" is a pointer to an object of type union bpf_attr. This object
  converts to a struct related to selected subcommand, and embeds the
  various parameters used with this subcommand. Some of those parameters
  are read by the kernel (example for an eBPF map lookup: the key of the
  entry to lookup), others are written into (the value retrieved from
  the map lookup).
- "attr_size" is the size of the object pointed by "attr".

Since the action performed by the kernel, and the way "attr" attributes
are processed depends on the subcommand in use, the PRE() and POST()
wrappers need to make the distinction as well. For each subcommand, mark
the attributes that are read or written.

For some map operations, the only way to infer the size of the memory
areas used for read or write operations seems to involve reading
from /proc/<pid>/fdinfo/<fd> in order to retrieve the size of keys
and values for this map.

The definitions of union bpf_attr and of other eBPF-related elements
required for adequately performing the checks were added to the Linux
header file.

Processing related to file descriptors is added in a follow-up patch.