Better audit_only lookup, convert sudo to hiera

Signed-off-by: Ben Agricola <bagricola@squiz.co.uk>