Function classify_bpf_program 

pub fn classify_bpf_program(prog_type: &str, name: &str) -> bool

Classify whether a BPF program type/name combination is suspicious.

Returns true for kprobe, lsm, raw_tracepoint_writable programs, and unnamed tracing/raw_tracepoint programs.