PS [DOCS] - audit log filter updates 8.4

[patrickbirch]

docs/audit-log-filter-formats.md
docs/audit-log-filter-json.md
docs/audit-log-filter-naming.md
docs/audit-log-filter-new.md
docs/audit-log-filter-overview.md
docs/audit-log-filter-restrictions.md
docs/audit-log-filter-security.md
docs/audit-log-filter-variables.md
docs/filter-audit-log-filter-files.md
docs/index-contents.md
docs/index.md
docs/manage-audit-log-filter.md
docs/reading-audit-log-filter-files.md
docs/write-filter-definitions.md
mkdocs-base.yml

[inikep]

Reviewed the audit_log_filter doc updates against the component source at components/audit_log_filter/ (PS 8.4). The bulk of the changes — system variables, UDFs, filter-definition JSON, formats, encryption/compression, file naming, and migration — verify correctly against the source.

Four factual errors need fixing (inline):

1. install-audit-log-filter.md — INSTALL COMPONENT 'file://audit_log_filter' is missing the component_ prefix; as written it fails to load.
2. block-statements-with-audit-filter.md — "Blocked statements are still logged" is backwards; blocked events go to the server error log, not the audit log.
3. block-statements-with-audit-filter.md — the "Not every event is abortable" section describes a "Can be Aborted" column and an abortability gate that don't exist in the docs or the component.
4. audit-log-filter-old.md — the OLD "Optional attributes" table lists five NEW-format-only elements (MYSQL_VERSION, OS_VERSION, STARTUP_OPTIONS, STATUS_CODE, VERSION).

Details and source citations are in the line comments.

[inikep]

I don't like wording from upstream. We don't block anything. We just skip (don't log) events:
▎ The Audit Log Filter component audits activity on the server you configure by recording events to a
▎ log. Filtering rules control which events are recorded — matching connections and statements are
▎ either logged or excluded.

[inikep]

Follow-up on the redact-audit-log-fields.md page: one factual correction on the count of replaceable fields (inline). The rest of the page verifies correctly against the component source.