audit: do not set FS_EVENT_ON_CHILD in audit marks mask