Audit entry "-e 2" is not guaranteed to be the last audit rule in audit.rule

>> Rules can be remediateed in any order. The only requirement is that the -e option is the last one in /etc/audit/audit.rules.

> I guess `augenrules` can handle that, but how about `auditctl`?

_Originally posted by @yuumasato in https://github.com/ComplianceAsCode/content/pull/5761#issuecomment-629282594_

Ordering rules so that `audit_rules_immutable` is the last of the audit rules to be scanned and remediated is a way to fix this issue.
But unless the OVAL check makes sure the `-e 2` is the last line in `/etc/audit/audit.rules`, this is not a guaranteed solution.