Add ability to make multiple syscalls for action rules

[isuftin]

Proposed feature

Add ability to have a rule written out such as -a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F auid>=500 -F auid!=4294967295 -k perm_mod

According to the documentation @ https://linux.die.net/man/7/audit.rules this is a valid format.

Currently this doesn't seem to be a thing @ https://github.com/robertdebock/ansible-role-auditd/blob/master/templates/custom.rules.j2#L20

I can do something like:

      - syscall: 'chmod -S fchmod -S fchmodat' 
        action: always
        filter: exit
        filters:
          - auid>=500
          - auid!=4294967295
        keyname: perm_mod

But it would be good to be able to accept either a string or list of strings for the syscall

Rationale

I am not blocked as I am able to work around it as shown above but a feature like this would be convenient