auditbeat: docs incorrectly state that socket_type will be reverted to unicast if multicast is not available

[efd6]

From here:

multicast can be used in kernel versions 3.16 and newer. By using multicast Auditbeat will receive an audit event broadcast that is not exclusive to a a single process. This is ideal for situations where auditd is running and managing the rules. If multicast is specified, but the kernel version is less than 3.16 Auditbeat will automatically revert to unicast.

Similar wording is in the auditd_manager integration here:

If it is set to true, but the kernel version is less than 3.16 it will be automatically disabled.

Remove this incorrect advice.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)