Use a plain struct for the kernel & userspace bpf events

[atenart]

Currently those two BPF events are parsed manually using raw.data. We should move to using a well defined struct and parse_single_raw_section.