auditd: Further improve signal handling

[des]

Summary

Rewrite the main loop to use ppoll() instead of just blocking on read,
blocking the signals we care about when we aren't polling.

I didn't bother replacing alarm() with setitimer(); the alarm code
is dead anyway since there is no way for max_idletime to acquire a
non-zero value.

MFC after: 1 week

[csjp]

Looks good a couple of minor things

contrib/openbsm/bin/auditd/auditd_fbsd.c

267

minor nit but NULL instead of 0 here

280

Another minor nit: Incrementing is misleading because it implies the count matters, when it doesn't. Using = 1 makes the intent explicit: this is a flag, not a counter

[des]

rf

[kevans]

contrib/openbsm/bin/auditd/auditd_fbsd.c

218

It occurs to me that we might want audiitwarning to have the previous mask available to restore the mask in the child

[des]

folded into D57451