journald: there's no point in turning on SO_TIMESTAMP for audit sockets, audit doesn't support timestamps anyway
journald: enable audit in the kernel when initializing

Similar to auditd actually turn on auditing as we are starting. This way
we can operate entirely without auditd around.
journald: properly decode audit's proctitle= field
journald: suppress low-level audit text prefix in MESSAGE= field

Let's make the log output more readable, and the header can be
reconstructed in full from the other fields
journal: when dumping log data with missing COMM fields, show "unknown" instead

A small readability improvement...
journald: don't pass around SO_TIMESTAMP timestamp for audit, which we don't have anyway
audit: improve the audit messages we generate

always pass along comm, as documented by audit. Always set the correct
comm value.
journal: also consider audit fields with '-' valid
journald: include audit message type number in MESSAGE= string