audit: allow user records to be created inside a container

Since user events will be followed by namespace information, userspace
can filter off undesired container records.

Signed-off-by: Aristeu Rozanski <arozansk@redhat.com>