disable CONFIG_GRKERNSEC_SYSCTL_ON

This causes the flags to be disabled by default, as they will be enabled
in a standard sysctl configuration instead. Otherwise, there is
unavoidable audit spam in early boot (timechange, mount).