[PATCH v2] audit: Report suspicious O_CREAT usage