Update rules to use more reliable container image predicates (#513)
Update rules to use more reliable container image predicates (#513)

Instead of using container.image, that always reports the raw string
used to spawn the container, switch to the more reliable
container.image.{repository,tag}, since they are guaranteed to report
the actual repository/tag of the container image.
This also give a little performance improvement since a single 'in'
predicate can now be used instead of a sequence of startswith.
draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco