Assess performance impact of auditd rules comparing "File System" and "System Calls" controls

#### Description of problem:

During the review of PR #9824 it was raised a question regarding the performance impact of changing auditd rules based on "File System" control to equivalent rules using "System Calls" control.

For example, the "File System" rule:
`-w /usr/bin/kmod -p x -F auid!=unset -k module-change`

Should be equivalent to the "System Call" rule:
`-a always,exit -F path=/usr/bin/kmod -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged`

The `auditctl` man page shows some examples of rules for the same purpose but written with both available controls.

The same man says that it is efficient to inform more syscalls in the same rule. So, would be created the opposite effect, of making it less efficient, if not informing any syscall?

The documentation is not clear about this and is prone to assumptions.
Considering the project has several `auditd` rules used in different profiles, it would be worth to collect evidences to clarify if the performance impact is relevant or not.