create a new template for audit watches

[vojtapolasek]

Currently, there is a template for audit watches, called audit_rules_watch.
This template uses the -w rule parameter. Citing Audit.rules man page:

Watches can also be created using the deprecated −w format which allows for backwards compatibility at the expense of system performance as explained. Using syscall rules as shown above, you can choose between path and dir which is against a specific inode or directory tree respectively. It should also be noted that the recursive directory watch will stop if there is a mount point below the parent directory. There is an option to make the mounted subdirectory equivalent by using a -q rule.

there should be a template which uses the new format, e.g.

−a always,exit −F arch=b64 -F path=path-to-file -F perm=permissions -F key=keyname