Part of the way towards #11864. We still don't have the auditd userland logging daemon, but journald also tracks audit logs so we can already use this.
