Fix auditd decoders

[tokibi]

Hi team,

This PR fixed an issue where auditd-generic decoders makes auditd.uid the same value as auid.

**Phase 1: Completed pre-decoding.
       full event: 'type=ANOM_ABEND msg=audit(1545007249.541:227013641): auid=4294967295 uid=1000 gid=33 ses=4294967295 pid=95382 comm="apache2" exe="/usr/sbin/apache2" sig=11'
       timestamp: '(null)'
       hostname: '31f8f1e5e096'
       program_name: '(null)'
       log: 'type=ANOM_ABEND msg=audit(1545007249.541:227013641): auid=4294967295 uid=1000 gid=33 ses=4294967295 pid=95382 comm="apache2" exe="/usr/sbin/apache2" sig=11'

**Phase 2: Completed decoding.
       decoder: 'auditd'
       audit.type: 'ANOM_ABEND'
       audit.id: '227013641'
       audit.pid: '95382'
       audit.auid: '4294967295'
       audit.uid: '4294967295'  <- same as auid
       audit.gid: '33'
       audit.session: '4294967295'
       audit.command: 'apache2'
       audit.exe: '/usr/sbin/apache2'

After this fix, auditd.uid will be the correct value.

**Phase 1: Completed pre-decoding.
       full event: 'type=ANOM_ABEND msg=audit(1545007249.541:227013641): auid=4294967295 uid=1000 gid=33 ses=4294967295 pid=95382 comm="apache2" exe="/usr/sbin/apache2" sig=11'
       timestamp: '(null)'
       hostname: '31f8f1e5e096'
       program_name: '(null)'
       log: 'type=ANOM_ABEND msg=audit(1545007249.541:227013641): auid=4294967295 uid=1000 gid=33 ses=4294967295 pid=95382 comm="apache2" exe="/usr/sbin/apache2" sig=11'

**Phase 2: Completed decoding.
       decoder: 'auditd'
       audit.type: 'ANOM_ABEND'
       audit.id: '227013641'
       audit.pid: '95382'
       audit.auid: '4294967295'
       audit.uid: '1000'  <- fixed
       audit.gid: '33'
       audit.session: '4294967295'
       audit.command: 'apache2'
       audit.exe: '/usr/sbin/apache2'

[Zenidd]

Hello @tokibi,

Sorry for our late reply.

We are going to review your PR and if possible, we will add it to Wazuh-ruleset. Thanks for your contribution!

Best regards,

Juan Pablo Sáez

[Lopuiz]

Hello @tokibi,

First of all, sorry for the late review. We appreciate your collaborations to the Ruleset project.

Thank you very much.

Regards, Eva