libaudit: fill structure audit_rule_data to use audit_add_rule_data