fix(rules): fixed container_started macro adapting to new container plugin

[FedeDP]

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area rules

Proposed rule maturity level

/area maturity-incubating
/area maturity-sandbox

What this PR does / why we need it:

In container_started macro, avoid using the meta, internal container event to check for spawned containers, since the new container plugin will send that event before the first process inside the container has spawned.
Instead, just rely on vpid==1 and container.id!=host.

Which issue(s) this PR fixes:

See falcosecurity/falco#3610

Fixes #

Special notes for your reviewer:

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [FedeDP]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[FedeDP]

Tested with Falco 0.41.0.

[github-actions]

Rules files suggestions

falco-incubating_rules.yaml

Comparing 2b2dbadb0d1f93f1f75e82160484102f24c45212 with latest tag falco-incubating-rules-5.0.0

Major changes:

• Rule Launch Privileged Container matches less events than before
• Rule Launch Excessively Capable Container matches less events than before
• Macro container_started matches different events than before

falco-sandbox_rules.yaml

Comparing 2b2dbadb0d1f93f1f75e82160484102f24c45212 with latest tag falco-sandbox-rules-5.0.0

Major changes:

• Rule Launch Sensitive Mount Container matches less events than before
• Rule Launch Disallowed Container matches less events than before
• Macro container_started matches different events than before