Use kube-audit-admin instead of kube-audit

[BernieWhite]

Existing rule

None

Suggested rule

Create a new rule Azure.AKS.AuditAdmin to flag when the kube-audit log is collected with diagnostic settings.

When kube-audit is enabled, this can significantly increase cost for monitoring AKS clusters.

Instead enable collection for kube-audit-admin, which excludes the get and list audit events, but includes changes.

Pillar

Cost Optimization

Additional context

Related to #2249

• https://learn.microsoft.com/azure/aks/monitor-aks#resource-logs