Update audit.rules.erb

only log on write or attribute access to /var/spool/cron/root