[RFC PATCH 4/5] audit: convert audit_ever_enabled to a boolean