retsnoop: support spawning child process to trace

[anakryiko]

Something like:

$ sudo retsnoop -c bpf -- ./my_app arg1 arg2

to start my_app and immediately trace it until it exits. This as a more usable alternative to process name and PID filters.