What this PR does / why we need it?

优化获取ssh session逻辑的执行顺序和检测方案，减少不必要开销

Summary of your change

• 先去过滤出符合条件的用户信息，确认有需要找 pid的用户再执行process.Processes()这个有开销的函数, 而不是先去查 process
• 把 proc.cmdLine 移出循环，只需要执行一次拿到值就够了
• 用 map 预存 host，直接通过 map[connect 的 IP] 来看是否命中

测试返回数据均不变

Please indicate you've done the following:

• Made sure tests are passing and test coverage is added if needed.
• Made sure commit message follow the rule of Conventional Commits specification.
• Considered the docs impact and opened a new docs issue or PR with docs changes if needed.