Tracee-rules: Pass events to signatures by reference

[AlonZivony]

It seems that we use only chan external.Eevent to pass events to signatures.
However, this means that we copy the event for each of the signatures. If each event is about 100 bytes and we have 100 signatures, it means that only for dispatching the event we write 10kb to the RAM for each event in worst case scenario (if all signatures use it) , but can be 1kb per event in a reasonable usage. It can escalate to enourmous amount of copying and memory use, especially if we consider that writing to the channel and reading from it both copy the struct, and for each internal function it is the same.
I think that passing reference to the event (using chan *external.Event) could improve the performance a lot (both for memory and CPU time). WDYT?

[AlonZivony]

The problem I see in this method is that each signature can modify the event and disturb other signatures operations.
There might even be concurrency issues of using the same memory situationally (I didn't researched it so I can't say).