Update op field in audit events
    
    The op field is used to describe the operation being performed. It
    needs to have a dash wherever there is a space to keep the name=value
    format of audit events from losing the content when parsing. This
    patch adds the dashes and expresses the actions in past tense so that it
    sounds better when read as part of a sentence.
    
    Signed-off-by: sgrubb <sgrubb@redhat.com>