Is your feature request related to a problem? Please describe.

related to #655

On high-core machines (32+ CPUs), Retina experiences significant performance degradation due to its use of BPF perf event arrays. The per-CPU buffer architecture causes non-linear degradation as core count increases, especially with multi-core traffic distribution (typical with RSS/multi-queue NICs) where each active CPU's buffer must be polled independently.

The current implementation uses hardcoded per-CPU buffer sizes (perCPUBuffer = 32 for packetparser, perCPUBuffer = 16 for dropreason) that were tuned for modest systems but are deployed on increasingly powerful hardware. Users have no way to configure buffer behavior to match their workload.

Describe the solution you'd like

Implement BPF ring buffers (BPF_MAP_TYPE_RINGBUF) with configurable buffer size as an alternative to perf event arrays for a more consistent scaling.

Describe alternatives you've considered

Additional context

Some analysis for a particular traffic pattern is available here: https://blog.zmalik.dev/p/who-will-observe-the-observability

Retina already uses github.com/cilium/ebpf v0.18.0 which includes the ringbuf package - no new dependencies required. Ring buffers require kernel 5.8+; Retina currently supports 5.4+, so a feature flag with automatic fallback would be great.