changes to auditd_policy.bro

big changes fixing many typos
take out SYSTEMS_DATA::new_socket() for now
need to finish out *what* to do when identity change has happened