investigate duplicate rename events from mount namespace

[fntlnz]

I've been reading in #70 that we are rightfully concerned about how our File probes are behaving when reporting paths related to an overlay filesystem (container filesystem, non root mount namespace)

I talked with @ferullo and he confirmed that the requirement for "step 1" is to always report the path as it is in the root mount namespace.

In certain circumstances, it could happen that an event is duplicated (e.g: we see both the unlink event in the container mount namespace and in the root mount namespace)

We need to make sure that for file create, rename and delete we only report the root mount namespace events.

[qcorporation]

ping @rhysre before working on