Map keep and events object to use in tracer, return rules_compat output

[sezen-datadog]

APPSEC-57260

derivatives are mapped to attributes with the new libddwaf version
When libddwaf returns keep, we have to flag the attribute manual-keep
events, consists in an array of events generated as a result of the rule evaluation process.
actions consists in a map of the actions, and their parameters, generated as a result of the rule evaluation process.
all three of these must be exposed to the tracer for us to be able to evaluate libddwaf results

rules_compat is a temporary attribute that holds the new rules return for libddwaf. this will eventually be merged to the rules attribute.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 55.93220% with 52 lines in your changes missing coverage. Please review.
✅ Project coverage is 57.42%. Comparing base (47c2db6) to head (1478aab).
⚠️ Report is 65 commits behind head on master.

Files with missing lines	Patch %	Lines
src/main/c/output.c	37.68%	30 Missing and 13 partials ⚠️
src/main/c/waf_jni.c	78.04%	2 Missing and 7 partials ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #178      +/-   ##
============================================
- Coverage     58.55%   57.42%   -1.14%     
- Complexity      134      175      +41     
============================================
  Files            34       34              
  Lines          3458     3643     +185     
  Branches        780      819      +39     
============================================
+ Hits           2025     2092      +67     
- Misses          900      977      +77     
- Partials        533      574      +41     

Flag	Coverage Δ
helper	57.42% <55.93%> (-1.14%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jandro996]

I’m probably missing some context, but I don’t quite understand this part:

When libddwaf returns keep, we have to flag the attribute manual-keep.

From what I can see, the attribute in the mapping is still keep, not manual-keep.

[jandro996]

LGTM