Audit linux filter create/free enable/disable functions for correct behaviour

[arr2036]

On fork all knotes associated with kqueues in the child are marked as disabled, the kqueues are then closed/freed which frees filter resources and knotes.

The filter knote free code needs to be audited to ensure that the registration state of any file descriptors with epoll is not altered in the child, as these changes will fail due to the child's kqueue's epoll handle being closed on fork.

The reason we close the epoll handle is because the parent and child will share the epoll instances, and modifications in the child would affect the parent.

The main purpose of the audit is to ensure we don't produce spurious errors and to ensure that the error paths in the filters don't have any side effects.

Audit has been completed for user events. I suspect the read filter is the one we'll have the most difficulty with.