Examine syscall provenance tracking for MacOS

[olevski]

Similarly to what we have done for spy. It would be nice to get a POC for tracking reading and writing of files via syscalls for MacOS.

This may be different for ARM vs Intel Macs. So any POC should document the architecture being used and if possible explore whether it is possible to implement things on the other architecture.

The goal is to be able to tell when a script/code/command calls the read/write syscalls and what files are being read/written.