- Updates for new glibc-kernheaders
    - Change auditctl to collect list of rules then delete them on -D
    - Update capp.rules and lspp.rules to comment out rules for the possible
        list
    - Add new message types
    - Support sigusr1 sender identity of newer kernels
    - Add support for ppid in auditctl and ausearch
    - fix auditctl to trim the '/' from watches
    - Move audit daemon config files to /etc/audit for better SE Linux
        protection