Add audit watch rules for file transfer protocols

File transfer (scp, rsync, etc.) from client machine is blind to the session recording.
So auditd should watch them as well, and we should have corresponding alert rules.

Start by locating the auditd rule configuration and the existing alert-rule definitions for monitored commands. Review how current rules and alerts are represented, then add coverage for scp and rsync file transfers and verify that the corresponding alerts trigger as expected.

Written by the indexing model from the issue text.