Multiple Rule Keys

[andy-rose-pantheon]

Auditctl supports the use of multiple rule keys in a rule. When coming back from auditctl, the rule keys are combined into a hex value separated by a SOH (Start of heading) character \x01.
(see -k in https://linux.die.net/man/8/auditctl)

PauditD should support this behavior from auditctl and have the ability to handle multiple rule keys. Rule keys from auditctl should be split and run through the filters independently. Additionally, output should be able to handle multiple messages originating from the separate rule keys.