[AUDIT] Log correct syscall args for i386 processes on x86_64

The i386 syscall ABI uses different registers. Log those instead of the
x86_64 ones.

Signed-off-by: David Woodhouse <dwmw2@infradead.org>