This adds a rule that makes it possible to "poison" all the matching events with
a specific `poison_tag`.

The tag is propagated to all its children, and further rules can match on the
specified tag, so for example, if one wanted to drop all the descendants of
bash, he could do:

/* Make a rule that poisons all my own children */
poison_rule = quark_ruleset_append_rule(&ruleset, RA_POISON, 7)
quark_rule_match_ppid(rule, getpid())

/* Drop all events that match my own children (the poison tag) */
drop_rule = quark_ruleset_append_rule(&ruleset, RA_DROP, 0);
quark_rule_match_poison(drop_rule, 7);

The idea is we can use this to drop trees of processes that match a certain
parameter.Poison because the tag "poisons" all its children.