journal: make JournalConfig.set_audit as enum

journal: make JournalConfig.set_audit as enum

In systemd <= 257, each set_audit tristate value had special meaning,
- true: enable the kernel audit subsystem,
- false: disable the kernel audit subsystem,
- negative: keep the current kernel audit subsystem state.

And the default is true, rather than negative. So, users sometimes
explicitly pass an empty string to Audit= setting to keep the state.

But since f48cf2a96dfdc23fe30ba0f870125fe55cab64c7 (v258), the negative
value is mistakenly used as 'really unspecified' even if an empty string
is explicitly specified.

This makes negative values handled as unspecified as usual, and assign a new
positive value AUDIT_KEEP for when an empty string is explicitly specified.
Also, make the Audit= setting accept "keep" setting, and suggest to use "keep"
rather than an empty string.

Fixes a regression caused by f48cf2a96dfdc23fe30ba0f870125fe55cab64c7 (v258).
Fixes #39057.