audit: refactor audit_receive_msg() to clarify AUDIT_*_RULE* cases