refactor(userspace/libsinsp): support field transformers in formatters

[jasondellaluce]

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area libsinsp

/area tests

Does this PR require a change in the driver versions?

What this PR does / why we need it:

This is the (hopefully) last PR on libs for the series of #1789. This lastly adds support to field transformers in libsinsp's formatters, which are also used to produce Falco rules outputs. Tests are included. This takes the chance for polishing a bit the implementation of sinsp_evt_formatter, which hasn't been touched for years.

After consulting with other maintainers and some product experts the UX decision has been that, whenever transformers are used in an output, the output field map (and the JSON output) will include both the non-transformed field and the transformed one. This will ensure that current expectations are not broken, while also including (optionally, configurable through API) the new information. Example taken from the tests:

TEST_F(sinsp_formatter_test, field_with_nested_transformer)
{
	format("start %tolower(toupper(proc.name)) end");
	EXPECT_EQ(m_last_res, true);
	EXPECT_EQ(m_last_output, "start init end");
	EXPECT_EQ(m_last_field_values.size(), 2) << pretty_print(m_last_field_values);
	EXPECT_EQ(m_last_field_values["proc.name"], "init");
	EXPECT_EQ(m_last_field_values["tolower(toupper(proc.name))"], "init");
}

Which issue(s) this PR fixes:

Special notes for your reviewer:

/milestone 0.17.0

Does this PR introduce a user-facing change?:

refactor(userspace/libsinsp): support field transformers in formatters

[FedeDP]

/approve
🚀

[poiana]

LGTM label has been added.

Git tree hash: 1f596a5c2cde4a503e072e01a292f0d97c72be88

[incertum]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, incertum, jasondellaluce

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [FedeDP,incertum,jasondellaluce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment