[TRACKING] Breaking changes in Falco 1.0.0

This issue keeps track of all deprecated Falco features that will be removed in Falco 1.0.0:

• append in Falco rule is deprecated in favor of override (see https://github.com/falcosecurity/falco/pull/2992)
• syntax like
  yaml复制

  - rule: Write below etc
    enabled: false

  is deprecated in favor of override (see https://github.com/falcosecurity/falco/pull/2992).
  yaml复制

    - rule: Write below etc
      enabled: false
      override:
         enabled: replace

  Please note that the enabled key is only deprecated when used as an override! So a rule like this is perfectly legit:
  yaml复制

  - rule: legit_rule
    desc: legit rule description
    condition: evt.type=open
    output: user=%user.name command=%proc.cmdline file=%fd.name
    priority: INFO
    enabled: false