fix(userspace/falco): when counting -M timeout, do not account for async events

[FedeDP]

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area engine

What this PR does / why we need it:

When using -M flag with eg: a plugin (like the container plugin) that generates asyncevents during the startup phase, could set first duration_start to a value that would be lower than first event retrieved from scap.
Bug spotted by the container plugin CI and the Falco testing framework: https://github.com/FedeDP/container_plugin/actions/runs/13546519679?pr=21

TestFalco_Miscs_PrometheusMetricsNoDriver
{"deadline":300000000000,"level":"info","msg":"running falco with runner","time":"2025-02-26T14:50:59Z"}
{"cmd":"/usr/bin/falco -c /etc/falco/falco.yaml -o append_output.suggested_output=false -o metrics.enabled=true -o metrics.output_rule=true -o metrics.interval=2s -o webserver.enabled=true -o webserver.prometheus_metrics_enabled=true -r single_rule.yaml -M 5 -o engine.kind=nodriver -o log_level=debug -o log_stderr=true -o log_syslog=false -o stdout_output.enabled=true","level":"debug","msg":"executing command","time":"2025-02-26T14:50:59Z"}
    miscs_test.go:137: 
        	Error Trace:	/__w/_actions/falcosecurity/testing/main/miscs_test.go:137
        	Error:      	Received unexpected error:
        	            	Get "http://127.0.0.1:8765/metrics": dial tcp 127.0.0.1:8765: connect: connection refused
        	Test:       	TestFalco_Miscs_PrometheusMetricsNoDriver

Basically, with the container plugin loaded and -M passed, Falco would leave immediately instead of waiting 5seconds (in nodriver mode) if there were containers running on the system.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

[FedeDP]

/milestone 0.41.0

[FedeDP]

/hold

[FedeDP]

/unhold

[leogr]

good catch!

[Andreagit97]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Andreagit97,FedeDP]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment