Drv - Intercept new process creation

[0xflux]

• Update the function to PsSetCreateProcessNotifyRoutineEx which allows the process to be killed before its creation. This here could also potentially beat early bird techniques
• Communication with UM before process is allowed to be created as per todo comments on onboard_new_process function in um_engine

[0xflux]

TODO: Research what indicators could be found with this one, this technique will most likely combat early bird techniques, create suspended techniques, etc. How this can detect those needs to be researched myself with a few poc's.