new(falco): add json_include_message_property to have a message field without date and priority

[LucaGuerra]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area engine

What this PR does / why we need it:

There are multiple discussions (#2985) about allowing JSON output that has a field containing only the rule output. One proposal is to change the output format but that would cause breaking changes, and also several tools (including possibly Falcosidekick) rely on a specific output format so it seems too risky to do that. However, we still want the pure unfiltered rule output, so we're introducing a new field called "message" to do just that. You can turn on and off both the output and message fields from your falco.yaml.

Example of the difference between the two:

  "message": "A process has started! (proc_exe=cat proc_sname=bash)",

  "output": "15:47:29.809967681: Warning A process has started! (proc_exe=cat proc_sname=bash)",

NOTE1: This PR is WIP because it depends on: #3308 , but it's useful to run the CI
NOTE2: I also wrote a much heavier modification to the test suite to allow this to be tested, but it involves creating sinsp events and so it's a bit messy, it'll require more discussion

Which issue(s) this PR fixes:

Fixes #2985

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

new(falco): add json_include_message_property to have a message field without date and priority

[github-actions]

This PR may bring feature or behavior changes in the Falco engine and may require the engine version to be bumped.

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

/hold

[LucaGuerra]

Please double check userspace/engine/falco_engine_version.h file. See versioning for FALCO_ENGINE_VERSION.

false positive

/unhold

[LucaGuerra]

/milestone 0.39.0

[FedeDP]

/approve

[poiana]

LGTM label has been added.

Git tree hash: 72b133d9d8fc77af867fe677be4852f7987bf8b5

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [FedeDP,LucaGuerra]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment