Apparmor and auditd changes

 * Add audit.log in beaver
 * Configure logstash indexer to parse apparmor messages regardless
   if they're coming from syslog or auditd.
Make auditd and apparmor its own section.

And add a bit of explanatory comments of what we’re doing here
Merge pull request #20 from ministryofjustice/kyr_audit

Apparmor and auditd changes