signature initialization events

[itaysk]

in #1031, the "k8s api connection" signature is using execve for one time probing into the container. I think that's an interesting use case we can solve in a better way (also common):

Ideas:

allow the signature to "unsubscribe" from execve after it has found the api server address. This will help with performance as signature will not get sent those events anymore.

split this into 2 signatures (not sure if signature is a good name for this), where one is just a "discover k8s api server" which is subscribed to execve, and the other is detecting connection and is relying on a value that the first signature populates.