Add Debian 13 auditd variable options and grub2 UEFI password OVAL

[israel-villar]

• var_auditd_disk_error_action: add cis_debian13=syslog|single|halt matching the CIS Debian 13 allowed values (same as cis_debian12).
• var_auditd_disk_full_action: add cis_debian13=halt|single matching the CIS Debian 13 allowed values (same as cis_debian12).
• grub2_uefi_password/oval/debian.xml: add Debian-specific OVAL check that verifies superusers and password_pbkdf2 entries in grub2_uefi_boot_path/grub.cfg (Debian stores GRUB config in a different path than RHEL, requiring a separate OVAL file).

Description:

• var_auditd_disk_error_action: add cis_debian13: syslog|single|halt
  (same allowed values as cis_debian12, per CIS Debian 13 section 6.3.4.x).
• var_auditd_disk_full_action: add cis_debian13: halt|single
  (same allowed values as cis_debian12).
• grub2_uefi_password/oval/debian.xml: new Debian-specific OVAL that
  checks for superusers and password_pbkdf2 entries in
  {{{ grub2_uefi_boot_path }}}/grub.cfg. Debian stores the GRUB
  configuration in a different path than RHEL and requires its own OVAL file.

Rationale:

Without the cis_debian13 variable options the profile cannot set the
correct allowed values via var_auditd_disk_error_action=cis_debian13
in the profile selections. The GRUB UEFI OVAL is needed because the
existing RHEL OVAL uses a different boot path macro value.

Review Hints:

• var_auditd_disk_*: one-line additions, mirror the cis_debian12 entries.
• grub2_uefi_password/oval/debian.xml: follows the same structure as
  the existing Ubuntu OVAL in the same directory.

[openshift-ci]

Hi @israel-villar. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.