[Feature]: Data-driven modules for Auditbeat (currently hardcoded in the template)

Unlike Filebeat (#510) and Metricbeat (#505), Auditbeat has its modules (auditd, file_integrity, system) hardcoded directly in auditbeat.yml.j2 — no variable at all, so changing the audit rules, file_integrity paths or system datasets requires editing the template. (Auditbeat has no modules command and configures modules inline by design.)

Add a beats_auditbeat_modules data-driven variable (a list of modules with their config), rendered inline into auditbeat.yml (auditbeat.modules:) by the same shared template/macro as #505/#510. This one list is the declarative desired state (in the list = enabled+configured; removed = gone; no separate disable list). Auditbeat is inline by nature, so there is no modules.d question here. Re-adapt the setup task here too (on top of #508's current-architecture fix): trigger auditbeat setup on this template's change (register/is changed, run_once).

Default = A (auditd + file_integrity, Elastic's own default), not B (our current set that also ships system). Reason: A keeps the default small so the auto-generated README variable table stays readable — a large system block would balloon the flattened default cell — and it matches upstream. system stays available; users just add it to the list.

Docs: shared roles/beats/docs/beats-modules.md (common model + an Auditbeat section with examples), linked from the beats_auditbeat_modules description; README table shows only the short default + the pointer.

Breaking (the default drops the system module vs today). Shares the macro + docs page with #505/#510.

arm64 note

The system/socket dataset is not built for arm64/aarch64 (elastic/beats#23349), so hardcoding it crashes Auditbeat on Apple Silicon / ARM hosts. Default A (auditd + file_integrity) avoids this, but beats-modules.md should note that socket is x86_64-only so ARM users don't add it blindly.

Depends on: #393 (shared plugin-as-data macro). Supersedes #509.

Start with auditbeat.yml.j2, the current Auditbeat setup task, and the shared plugin-as-data macro from #393, comparing the related work in #505 and #510. Read roles/beats/docs/beats-modules.md for the shared model and documentation requirements. Done means the modules variable renders inline, setup reacts to template changes, the default and ARM socket note are documented, and the README points to the shared page.