[BugFix] [Enhancement] [RHEL/6] audit file system watch rules remediations

This proposal does the following:
* patch 1 ```audit_rules_time_watch_localtime``` rule:
  * introduce new RHEL-6 remediation functions library to be placed under:  ```/usr/share/scap-security-guide/functions``` path into the RPM (to share remediation functions implementation)
  * introduce ```fix_audit_watch_rule``` function which can be used to remediate audit file system watch 
rules, e.g. those having the expected form:  ```-w file_path -p access_mode -k audit_search_key```
  * apply that remediation function to implement RHEL-6 remediation for audit_time_rules_watch_localtime rule

* patch 2 ```Record Events that Modify User/Group Information``` audit rule:
  * unify XCCDF ID with OVAL ID (in xccdf & profile references),
  * implement RHEL-6 remediation (using the ```fix_audit_watch_rule``` remediation function)

* patch 3 ```Record Events that Modify User/Group Information``` audit rule:
  * bugfix the OVAL check - allow 'aw' together with 'wa' access type (since they are equivalent),
  * enhancement OVAL check - allow stronger access type containing 'wa/aw' as minimum (e.g. make the check to PASS even when system administrator wants to audit also 'rx' events, IOW when the final access mask is 'rxaw'

* patch 4 ```audit_mac_changes``` rule:
  * unify XCCDF ID with OVAL ID (in xccdf & profile references),
  * fix the OVAL check to allow 'aw' or stronger access types (e.g. 'rxaw'),
  * add RHEL-6 remediation,

* patch 5 ```audit_rules_sysadmin_actions``` rule:
  * unify XCCDF ID with OVAL id (in xccdf & profile references),
  * fix the OVAL check to use the template regex from audit_rules_time_watch_localtime (IOW it to allow to pass also 'aw' or stronger e.g. 'rxwa' access masks,
  * implement RHEL-6 remediation for this rule (utilizing the ```fix_audit_watch_rule``` function).

Testing report:
--
The proposed change has been tested on RHEL-6 on both archs (32-bit & 64-bit) & works as expected for all four rules (particular rule is referenced under new OVAL name, the OVAL check allows access type to contain 'aw' or something stronger e.g ' xaw' or 'rawx' - the order doesn't matter, & provided remediation scripts work for each of them - when not present, they are added, when particular file path already present in ```/etc/audit/audit.rules```, but not with 'aw | wa' access type, the -p value is updated the rule to meet the requirements).

Please review.

Thank you, Jan.