Disable auditing by default

[vpavic]

Out-of-the-box auditing is backed by InMemoryAuditEventRepository which I believe, as already expressed in #11605 (comment), isn't appropriate for production use due to:

• limited storage capabilities
• memory consumption
• not being cluster ready

I would propose to disable this by default and make the whole AuditAutoConfiguration conditional on presence of AuditEventRepository bean, rather than it having register InMemoryAuditEventRepository itself.

This would also be somewhat consistent with the #15039.

[mrifni]

Hi, I would like to work on this if possible with some guidance. Please let me know.

[wilkinsona]

Thanks for the offer, @mrifni. I think we might need to do a bit of design work until we're ready to implement something here. One option is to do as @vpavic suggests. Another would be to make AuditAutoConfiguration conditional on a property that's false by default. Whatever we do will need to consider #15039 at the same time so that things are consistent. Please leave it with us for now while we figure out what changes we'd like to make.

[mrifni]

sure