add sys_execve to inspect

To inspect sys_execve via ftrace could cover more unexpected cases that do_execve and stub_execve would fail.