feat/fix(bpflsm-enforcer): refactor network rule handling

[daemon1024]

• Fixes the issue where we don't a default deny but Allow policy start enforcing as Block rules. We now explicitly have a deny flag in value if they are block rules

• Added sock_create hook to cover gaps in net enforcement

If the changes in this PR are manually verified, list down the scenarios covered::
Changed Default Network Posture and tested with allow based network policy

Checklist:

• Bug fix. Fixes feat(enforcer(bpf)): Block bind(), listen(), recvmsg(), and sendmsg(). #1254
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• PR Title follows the convention of <type>(<scope>): <subject>
• Commit has unit tests
• Commit has integration tests

[DelusionalOptimist]

Tested with BPF LSM on both GKE COS and Bottle Rocket. Looking good.

However only on GKE it the policyName still shows up as DefaultPosture for network alerts:
Policy:

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: ksp-ubuntu-1-allow-net-tcp-from-source
  namespace: multiubuntu
spec:
  severity: 8
  selector:
    matchLabels:
      container: ubuntu-1
  network:
    matchProtocols:
    - protocol: tcp
      fromSource:
      - path: /usr/bin/curl
  action: Block

Alerts

ClusterName: default
HostName: gke-kubearmor-prerelease-default-pool-e3a63478-9v14
NamespaceName: multiubuntu
PodName: ubuntu-1-deployment-6677c64b97-kksgt
Labels: group=group-1,container=ubuntu-1
ContainerName: ubuntu-1-container
ContainerID: 8f7b3fd7841da835154e2c9273cab9a24fc73d5847d666db09d654651d28f106
ContainerImage: docker.io/kubearmor/ubuntu-w-utils:0.1@sha256:b4693b003ed1fbf7f5ef2c8b9b3f96fd853c30e1b39549cf98bd772fbd99e260
Type: MatchedPolicy
PolicyName: DefaultPosture
Source: /usr/bin/curl google.com
Resource: domain=AF_UNIX type=SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC protocol=0
Operation: Network
Action: Block
Data: syscall=SYS_SOCKET
Enforcer: BPFLSM
Result: Permission denied
HostPID: 193996
HostPPID: 192690
Owner: map[Name:ubuntu-1-deployment Namespace:multiubuntu Ref:Deployment]
PID: 122
PPID: 101
ParentProcessName: /bin/bash
ProcessName: /usr/bin/curl
== Alert / 2023-06-27 11:34:43.472903 ==
ClusterName: default
HostName: gke-kubearmor-prerelease-default-pool-e3a63478-9v14
NamespaceName: multiubuntu
PodName: ubuntu-1-deployment-6677c64b97-kksgt
Labels: group=group-1,container=ubuntu-1
ContainerName: ubuntu-1-container
ContainerID: 8f7b3fd7841da835154e2c9273cab9a24fc73d5847d666db09d654651d28f106
ContainerImage: docker.io/kubearmor/ubuntu-w-utils:0.1@sha256:b4693b003ed1fbf7f5ef2c8b9b3f96fd853c30e1b39549cf98bd772fbd99e260
Type: MatchedPolicy
PolicyName: DefaultPosture
Source: /usr/bin/curl google.com
Resource: domain=AF_INET type=SOCK_STREAM protocol=TCP
Operation: Network
Action: Block
Data: syscall=SYS_SOCKET
Enforcer: BPFLSM
Result: Permission denied
HostPID: 193996
HostPPID: 192690
Owner: map[Name:ubuntu-1-deployment Namespace:multiubuntu Ref:Deployment]
PID: 122
PPID: 101
ParentProcessName: /bin/bash
ProcessName: /usr/bin/curl