Fix rsyslog OVAL patterns to support RainerScript syntax

[Arden97]

Description:

• Updated OVAL pattern matching rules in the DISA STIG RHEL9 v2r6 XCCDF/SCAP reference file to properly detect rsyslog configurations that use comma-separated lists and RainerScript syntax format. The changes affect pattern matching for auth.*, authpriv.*, and daemon.* log entries in both /etc/rsyslog.conf and /etc/rsyslog.d/*.conf files
• SSG OVAL check for rsyslog_remote_access_monitoring was also updated to match entries with semicolon separator

Rationale:

• The previous OVAL patterns only recognized semicolon-separated syntax, causing false negatives when systems used valid comma-separated configurations or RainerScript format entries. This resulted in compliant rsyslog configurations being incorrectly flagged as non-compliant during SCAP scans

• The new regex pattern now also matches:

  • auth,authpriv.* /var/log/secure
  • authpriv.* action(file="/var/log/secure" type="omfile")
  • auth,authpriv.* action(type="omfile" file="/var/log/secure")

• Fixes DISA Misalignment rsyslog_remote_access_monitoring SSG result: pass, DISA result(s): fail #14229

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

ATEX Test Results

Test artifacts have been submitted to Testing Farm.

Results: View Test Results
Workflow Run: View Workflow Details

This comment was automatically generated by the ATEX workflow.