Add audit monitoring for SELinux policy changes in /var/lib/selinux

[Arden97]

Description:

• This PR expands CIS requirements to cover custom selinux policies
• Created new rule audit_rules_mac_modification_var_lib_selinux to monitor /var/lib/selinux/ directory
• Integrated the rule into CIS benchmarks for RHEL 8, 9, 10, and Fedora
• Added the rule to HIPAA and CUSP compliance profiles
• Extended OVAL checks to properly support Fedora alongside RHEL 10 and OL 10
• Added new setup_augenrules_environment() macro to configure test environments for augenrules
• Updated all audit_rules_watch template tests to use the new environment setup macro

Rationale:

• Fixes OPENSCAP-4183
• The CIS policy does not mention the /var/lib/selinux
• However, as was discussed in the linked issue, monitoring the active policy store is also important to ensure kernel policy integrity

Review Hints:

• use automatus to verify, that new rule functions correctly on mentioned systems

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[Arden97]

/packit retest-failed