Add documentation for ":on" option, to limit which actions are audited

There's a nice feature to limit which actions are audited, to avoid, for example, auditing of "create". It's not documented, so I added a small snippet about it in the README.