 rule(Delete or rename shell history):fix warning
 rule(Delete or rename shell history):fix warning

Move the "and not" checks to the end of the rule so all event type
checks are at the front.

Also break into 3 macros to make the rule easier to read.

This fixes https://github.com/falcosecurity/falco/issues/1418.

Signed-off-by: Mark Stemm <1b6cbc2e568a933a16c6fa30b73e50cd507debf7@gmail.com>

draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco,draios/falco