audit: move audit_get_tty to reduce scope and kabi changes