Add advisory to tutorial about different syscall

[128f]

It appears on some systems, do_sys_open is called rarely. This changes the tutorial to acknowledge that, and instructs the reader to attach the kprobe to two syscalls. Some copy was added to the tutorial explaining the reasoning for this.

In response to https://github.com/foniod/redbpf/issues/277#issue-1125441020

[rhdxmr]

Wow this is brilliant. That's very helpful advisory. I didn't know this fact. Thanks a lot.

All I want to ask you is to change your commit message to contain Signed-off-by trailer since redbpf conforms DCO. You can do that by executing git commit -s option :slightly_smiling_face:

[128f]

@rhdxmr done