Falco 0.38.0 crashes with -pc/-pk and any plugin loaded

[LucaGuerra]

Describe the bug

Deploy Falco 0.38.0 with any configuration that has -pc or -pk and enable a plugin, such as k8s_audit

Defaulted container "falco" out of: falco, falcoctl-artifact-follow, falco-driver-loader (init), falcoctl-artifact-install (init)
Tue Jun  4 08:56:33 2024: Using deprecated config key 'rules_file' (singular form). Please use new 'rules_files' config key (plural form).
Tue Jun  4 08:56:33 2024: Falco version: 0.38.0 (x86_64)
Tue Jun  4 08:56:33 2024: Falco initialized with configuration files:
Tue Jun  4 08:56:33 2024:    /etc/falco/falco.yaml
Tue Jun  4 08:56:33 2024: System info: Linux version 5.15.0-72-generic (buildd@lcy02-amd64-035) (gcc (Ubuntu 11.3.0-1ubuntu1~22.04.1) 11.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #79-Ubuntu SMP Wed Apr 19 08:22:18 UTC 2023
Tue Jun  4 08:56:33 2024: Loading plugin 'k8saudit' from file /usr/share/falco/plugins/libk8saudit.so
Tue Jun  4 08:56:33 2024: Loading plugin 'json' from file /usr/share/falco/plugins/libjson.so
Tue Jun  4 08:56:33 2024: Loading rules from file /etc/falco/falco_rules.yaml
Tue Jun  4 08:56:33 2024: Loading rules from file /etc/falco/k8s_audit_rules.yaml
Error: /etc/falco/k8s_audit_rules.yaml: Invalid
1 Errors:
In rules content: (/etc/falco/k8s_audit_rules.yaml:0:0)
    rule 'Disallowed K8s User': (/etc/falco/k8s_audit_rules.yaml:122:2)
    rule output: (/etc/falco/k8s_audit_rules.yaml:125:10)
------
  output: K8s Operation performed by user not in allowed list of users (user=%ka.user.na...
          ^
------
LOAD_ERR_COMPILE_OUTPUT (Error compiling output): invalid formatting token container.id container_image=%container.image.repository container_image_tag=%container.image.tag container_name=%container.name k8s_ns=%k8s.ns.name k8s_pod_name=%k8s.pod.name

If you think about it, this is actually the same concept as #466

[sboschman]

Possibly introduced by #3135 ? Which fixed the -p not being applied to output from other sources than syscall, i.e. k8s_audit. Perhaps a distinction can be made which flag is used? Apply -p to all sources and apply -pc/-pk only to syscall source?