libapparmor: allow parsing of logs with 0x1d + uppercase items

audit.log lines on Arch have an additional FSUID="username" OUID="username", separated from the previous part of the log line with 0x1d.

Extend the log parsing to accept 0x1d as whitespace, and to recognize (and ignore) FSUID and OUID.

Fixes: #271 (closed)

Also add one of the log lines from #271 (closed) as test_multi test case.

I propose this patch for 3.0..master.