fix(userspace/libsinsp): properly set successful lookup state when parsing old container json events

[FedeDP]

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area libsinsp

Does this PR require a change in the driver versions?

What this PR does / why we need it:

This PR fixups a small bug indirectly caused by the changes in #1707.
Default at successful lookup state when lookup_state is not part of the container json event.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Falco CI uses very very old container events in scap files (prior to 58a546a changes) thus one event was expected but not received becase it had no lookup_state field.
See https://github.com/falcosecurity/falco/actions/runs/8802240019?pr=3177:

TestFalco_Legacy_ContainerPrivileged
{"deadline":180000000000,"level":"info","msg":"running falco with runner","time":"2024-04-24T08:33:14Z"}
{"cmd":"/usr/bin/falco -c /etc/falco/falco.yaml -o json_output=true -r falco_rules.yaml -o engine.kind=replay -o engine.replay.capture_file=container-privileged.scap -A -o json_include_output_property=false -o json_include_tags_property=false -o log_level=debug -o log_stderr=true -o log_syslog=false -o stdout_output.enabled=true","level":"debug","msg":"executing command","time":"2024-04-24T08:33:14Z"}
legacy_test.go:2526:
Error Trace: /home/runner/work/_actions/falcosecurity/testing/main/legacy_test.go:2526
Error: Not equal:
expected: 3
actual : 2
Test: TestFalco_Legacy_ContainerPrivileged

Does this PR introduce a user-facing change?:

NONE

[FedeDP]

/milestone 0.16.0
/cc @incertum

[FedeDP]

Without the change:

Events detected: 2
Rule counts by severity:
   INFO: 2
Triggered rules by rule name:
   Launch Sensitive Mount Container: 2

With the change:

Events detected: 3
Rule counts by severity:
   INFO: 3
Triggered rules by rule name:
   Launch Sensitive Mount Container: 3

[Andreagit97]

this is useful only for old scap-files

[Andreagit97]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, leogr, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97,FedeDP,LucaGuerra,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment