rule(macro exe_running_docker_save): add new cmdline
rule(macro exe_running_docker_save): add new cmdline

While using Falco, I noticed we were getting many events that were
virtually identical to those that were previously filtered out by the
`exexe_running_docker_save` macro, but where the `cmdline` was something
like `exe /var/run/docker/netns/cc5c7b9bb110 all false`. I believe this
is caused by the use of docker-in-docker.

Signed-off-by: Nicolas Marier <bc5c24836fb50a9048530c71983a6acb86f93de8@coveo.com>

draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco