Extend documentation of audit settings

Various aspects of audit settings are not yet documented:

1. Are audit settings (event selection, user filter) are applied cluster-wide or per node? 
2. Are audit settings (event selection, user filter) persistent?
3. How can audit settings (event selection, user filter) be applied in a programmatic way (over CLI or REST API)?
4. What are possible internal events and internal users and how to filter them out if required?