Consider having separate executables for streaming and converting

[spbnick]

At the moment aushape has a single executable, which can be used for both streaming audit log to syslog (and possibly other targets) and doing single-shot conversion. This results in a somewhat complicated interface, which might be confusing and difficult to understand for new users.

Consider making two separate programs using the same library: one for single-shot conversion, another for streaming.

The benefits can be simpler interface and clearer separation of purpose. The downside can be either inability to stream an already saved file, or having the interface complexity of the streaming program to be about the same.