ebpf: fall back to proc parsing when we detect a late event

[iaguis]

There is a kernel bug introduced by torvalds/linux@27727df (see bcc's report) that makes timestamps be wrong and results in messages like this in scope's logs:

<probe> ERRO: 2017/03/13 12:33:19.623907 ERROR: late event!

Moreover, this can result in connectevents closely followed by close events to be in reverse order, causing the connection to never disappear from scope.

This bug was introduced in 4.8 but was backported to older kernels by distros. The fix was included in 4.9 and also backported. For example, in Ubuntu, the bug was introduced in kernel 4.4.0-42 and it's not fixed until kernel 4.4.0-51.

We should fall back to proc parsing when we detect a late event.

cc @alban @schu