Description of Changes

This PR fixes OSPP file activity auditing coverage for session users in Ghaf VMs.

• Updates OSPP create, modification, and delete audit rules to use auid!=unset instead of auid>=1000.
• Ensures file activity events from logged-in users with non-standard UIDs (for example ghaf, UID 901) are captured.
• Keeps other OSPP rule groups unchanged (for example access, permission-change, ownership-change) to limit noise increase.
• Adds openat2 coverage to OSPP create rules so newer create syscalls are also audited.

Type of Change

• New Feature
• Bug Fix
• Improvement / Refactor

Related Issues / Tickets

https://jira.tii.ae/browse/SSRCSP-8000
https://jira.tii.ae/browse/SSRCSP-6940

Checklist

• Clear summary in PR description
• Detailed and meaningful commit message(s)
• Commits are logically organized and squashed if appropriate
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• Author has run make-checks and it passes
• All automatic GitHub Action checks pass - see actions
• Author has added reviewers and removed PR draft status

Testing Instructions

Applicable Targets

• Orin AGX aarch64
• Orin NX aarch64
• Lenovo X1 x86_64
• Dell Latitude x86_64
• System 76 x86_64

Installation Method

• Requires full re-installation
• Can be updated with nixos-rebuild ... switch
• Other:

Test Steps To Verify:

1. Enable audit and OSPP rules
   1.1. Enable audit option to be true security.audit.enable = true; under ghaf/modules/reference/profiles/mvp-user-trial.nix
   1.2 Enable OSPP rules to true default=true under ghaf/modules/common/security/audit/default.nix (inside 'enableOspp = mkOption'))
2. Build the image, flash and boot
3. SSH to chrome-vm (or any vm)
4. Create a new file touch /tmp/testfile.txt
5. Grafana should show logs for the creation/modification/deletion of a file: