Auto mode for packetparser ring buffer

[SRodi]

Summary

Add an auto mode so packetparser can decide at runtime whether to use BPF_MAP_TYPE_RINGBUF or BPF_MAP_TYPE_PERF_EVENT_ARRAY based on node characteristics. This follows the discussion in #1981 where a tri‑state configuration was preferred over a boolean.

Motivation

Ring buffers can improve performance and memory efficiency on high‑core nodes, but may not be optimal for all environments. Users should not need to manually choose in most cases. An auto mode lets Retina make a safe, data‑driven choice at runtime while still allowing explicit enabled/disabled overrides.

Proposed Configuration

Replace the boolean with a tri‑state:

packetParserRingBuffer: auto     # Let Retina decide
packetParserRingBuffer: enabled  # Always use ring buffer
packetParserRingBuffer: disabled # Never use ring buffer

Runtime Decision (Auto)

Define and document a runtime decision policy, for example:

• Consider CPU core count, memory size, and kernel support.
• Prefer ring buffer on high‑core nodes or when perf event array overhead is high.
• Fall back to perf event array when ring buffer prerequisites or sizing constraints are not met.

The policy should be explicit, testable, and logged at startup.

Acceptance Criteria

• packetParserRingBuffer accepts auto|enabled|disabled (default: auto).
• auto mode chooses ring buffer or perf array at runtime using a documented policy.
• Startup logs clearly state the selected mode and why.
• Helm values, config schema, and docs updated to reflect tri‑state.
• E2E profile updated to cover ring buffer enabled and auto mode.
• Unit tests cover config parsing and the decision logic.

Implementation Notes

• Update config types and validation to support tri‑state values.
• Update BPF compilation flags and reader initialization to respect resolved mode.
• Ensure ring buffer size limits are validated/sane defaults are applied in auto mode.
• Keep compatibility with existing boolean values if possible (e.g., map true->enabled, false->disabled) with deprecation notice.

Testing

• Unit tests for config parsing and decision logic.
• Existing packetparser tests run with ring buffer enabled.
• E2E tests in test/profiles/advanced/values.yaml updated to include enabled and auto.

Documentation

• Explain when and why auto chooses ring buffer vs perf array.
• Add pros/cons and tuning guidance (ring buffer size, constraints).

References

• PR discussion: feat(packetparser): add configurable BPF Ring Buffer support #1981
• Related issue: offer configurable BPF ring buffers (BPF_MAP_TYPE_RINGBUF) impl in packetparser #1966