fix: pass order of auditd::rule to concat::fragment