[FEATURE] Use kernel eBPF runtime for bpftime

[yunwei37]

Is your feature request related to a problem? Please describe.

As discussed before, we need to use kernel eBPF runtime if the prog access kernel data structures like task_struct.

We can use a syscall instead of trap, and may gain 2x less overhead because syscalls are more lightweight.

Describe the solution you'd like

See the kernel-vm branch for poc. We should find a better way to make it work with libbpf.

Describe alternatives you've considered

Provide usage examples

Additional context

[Officeyutong]

We may run eBPF programs with bpf_test_run when entering hooks such as uprobe. Maps might be automatically converted to shared maps.