feat: implement eBPF hiding and warning suppression

[ania0-art]

Description

Implemented advanced stealth features for TripleCross, focusing on eBPF component invisibility and kernel warning suppression.

Changes

• eBPF Self-Hiding:
  • Intercepts sys_bpf to filter out rootkit IDs from bpftool enumeration.
  • Blocks BPF_PROG_GET_FD_BY_ID to prevent direct access to hidden programs.
• Warning Suppression (Theater Mode):
  • Hooks /dev/kmsg reads to mask bpf_probe_write_user warnings.
  • Replaces security alerts with benign system logs using a safe_len verifier-friendly logic.

Environment

• OS: Ubuntu 22.04 LTS
• Kernel: 5.15.139-generic

Screenshots

## Known Limitations - Masks are only applied to audit processes started AFTER the rootkit is loaded. - Primarily optimized for `dmesg` utility.

Note: Some comments in the code are currently in Chinese as they were part of my research notes. I am happy to translate them into English if needed for the review.
Sent a more detailed email regarding the implementation background to you.