Incorrect expected behavior of BPF_MAP_TYPE_LRU_HASH

[oshaked1]

According to the documentation for eBPF hash maps (https://docs.kernel.org/bpf/map_hash.html), an LRU hash map is expected to evict the least recently used item when attempting to insert an element when the map is full.

Despite this description, the implementation for the LRU hash map behaves in a way that causes maps with a small number of max entries to behave unexpectedly. See https://stackoverflow.com/questions/75882443/elements-incorrectly-evicted-from-ebpf-lru-hash-map for an example and discussion.

Tracee uses a few small capacity LRU hash maps (io_file_path_cache_map, elf_files_map, recent_deleted_module_map). They should be reviewed to make sure that they don't rely on incorrect assumptions about the behavior of the LRU map.