Use the journal instead of audit.log

The minimal images no longer ship auditd and thus do no have audit.log around. However, the audit messages are captured in the systemd journal, so use it instead.