audit: join tty records to their syscall

AUDIT_TTY records were logged as seperate events from their syscall
records.  Join them so they are logged as the single event that they
are.

Please see the github issue
https://github.com/linux-audit/audit-kernel/issues/106



Signed-off-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>