auditd 5.2.3.12 logins should refer to /var/run/faillock

[kdebisschop]

Describe the Issue
In templates/audit/ubtu20cis_5_2_3_12_logins.rules.j2, auditd 5.2.3.12 logins should refer to /var/run/faillock and not /var/log/faillock.

From CIS:

Verify the output matches:

-w /var/log/lastlog -p wa -k logins
-w /var/run/faillock -p wa -k logins

From man pam_faillockK

FILES
/var/run/faillock/*
the files logging the authentication failures for users

Expected Behavior
The audit rules should match the specification of the CIS controls and should pass scans by other software (e.g., Wazuh SIEM)

Actual Behavior
The current rule does not reflect the CIS control or the behavior of pam_faillock

Control(s) Affected

5.2.3.12

Environment (please complete the following information):

• branch being used: devel
• Ansible Version: 2.5.16
• Host Python Version: 3.12.0
• Ansible Server Python Version: [e.g. Python 3.7.6]
• Additional Details:

Additional Notes
Anything additional goes here

Possible Solution
See #114