Fix rule eviction order for AUDIT_DIR

If syscall removes the root of subtree being watched, we
definitely do not want the rules refering that subtree
to be destroyed without the syscall in question having
a chance to match them.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --cc kernel/audit.c
Simple merge

diff --cc kernel/audit.h
Simple merge

diff --cc kernel/audit_tree.c
Simple merge

diff --cc kernel/auditsc.c
Simple merge