chore: don't include auditd rules in Linux VHDs

[jackfrancis]

Reason for Change:

This PR changes the VHD configuration so that auditd rules are not put onto the VM filesystem as part of VHD creation. Also includes required ARM template composition changes due to the fact that there is no VHD context related to the need for these cloud-init requirements.

Issue Fixed:

Credit Where Due:

Does this change contain code from or inspired by another project?

• No
• Yes

If "Yes," did you notify that project's maintainers and provide attribution?

• No
• Yes

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• tested upgrade from previous version

Notes:

[acs-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jackfrancis

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jackfrancis]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

Merging #4253 (b95d88f) into master (308f241) will decrease coverage by 0.01%.
The diff coverage is 71.42%.

@@            Coverage Diff             @@
##           master    #4253      +/-   ##
==========================================
- Coverage   72.08%   72.06%   -0.02%     
==========================================
  Files         141      141              
  Lines       21715    21725      +10     
==========================================
+ Hits        15653    15657       +4     
- Misses       5107     5112       +5     
- Partials      955      956       +1     

Impacted Files	Coverage Δ
pkg/engine/armvariables.go	85.74% <0.00%> (-0.40%)	⬇️
pkg/engine/templates_generated.go	43.42% <ø> (ø)
pkg/api/types.go	92.86% <100.00%> (+0.05%)	⬆️
cmd/rotate_certs.go	11.03% <0.00%> (-0.11%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 308f241...b95d88f. Read the comment docs.

[jadarsie]

This method makes it look like auditDEnabled is a cluster-wide setting, but the apimodel schema may give the wrong impression to users as the field can be set on both master and agent pools.

Out of scope if auditD will be removed eventually.

[jackfrancis]

It's just because both node types derive cloud-init data from a common dictionary that gets populated to the ARM template. So if any one node pool (or control plane) opts into auditd, that data is needed in the template in order to be consumed by cloud-init anywhere.