new(falco): enable CLI options with -o key={object}

[LucaGuerra]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area engine

What this PR does / why we need it:

In #3308 we add a new configuration option such as:

append_output:
  - source: syscall
    tag: persistence
    rule: some rule name
    format: "gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4]"

Given its format, it is not possible to specify it on the command line with a -o option unless we enable a syntax like -o key={object}, or -o key[]={object}. Example: -o append_output[]={"source": "syscall", "tag": "persistence", "rule": "some rule name", "format": "gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4]"}. This PR does exactly that.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

For now, we are not enabling lists here but they can be allowed as well.

Does this PR introduce a user-facing change?:

new(falco): enable CLI options with -o key={object}

[LucaGuerra]

/milestone 0.39.0

[FedeDP]

/approve
Neat, thanks!

[poiana]

LGTM label has been added.

Git tree hash: a28816c9866ca21508908e207b9cc088b378f1fe

[Andreagit97]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97,FedeDP,LucaGuerra]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment