We garbage collect things after 4 seconds, this is to allow lookups from the
user to still work.

Previously we were garbage collecting after the cycle, meaning we could
theoretically end up doing a lookup for a quark_process
mid-quark_queue_get_event(), then stash it into qev->process, and then free the
memory in gc_collect(). This would be very unlikely since we would need an event
that references the soon-to-be-collected process to arrive 4 seconds later.

Give me back my sleep, make it impossible by collecting everything before we
have a chance of referencing it.

This implements the barebones of a rule system for filtering events.

A ruleset is a collection of rules.
A rule has zero or more rule_fields. Each rule_field expresses one attribute
that must match, for example process.pid is one field, and file.path is another.
A rule matches when _all_ its fields match.
A rule with no fields always matches (can be a catch-all as the last rule).
A ruleset matches the first rule it matches, meaning this is a match-first scheme.

Currently we have only two actions RA_PASS and RA_DROP, if nothinig matches,
it's PASS.
For now, only 4 rule_fields, process.pid, process.ppid, process.filename and
file.path.

The next step is to design a proper DSL ala pf.conf(5), that then compiles an
ascii line-based ruleset into a quark_ruleset.

Co-authored-by: Nicholas Berlin <56366649+nicholasberlin@users.noreply.github.com>