[Auditbeat] MacOS auditing

There is some built-in auditing support in macOS. I don't know much about it yet, but it sounds like we can get execve info at a minimum. This needs more investigation.
- https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man2/auditon.2.html
- https://ilostmynotes.blogspot.com/2013/10/openbsm-auditd-on-os-x-these-are-logs.html
- https://github.com/objective-see/ProcInfo/blob/e6c01fdf69a605491aa52d7466888ef1f3f2e984/procInfo/ProcessMonitor.m#L125
- `sudo praudit -l /dev/auditpipe`

Start by investigating the Apple auditon.2 documentation and the OpenBSM notes linked in the issue. Run `sudo praudit -l /dev/auditpipe` and review the referenced ProcInfo ProcessMonitor.m code to determine whether macOS can provide execve data. Done means establishing the feasible audit data and a defined scope for Auditbeat support.

Written by the indexing model from the issue text.