BPF vs KPROBE process start_ttime

[haesbaert]

bpf reads from group_leader->start_time
kprobe reads from task_struct->start_time

There's a slight difference, I see 300ns. It might make sense to use the exact same as to facilitate debugging, but quark theoretically still supports threads (which is per task_struct->start_time), so we should zap thread support and unify this.