Move install_mcafee_hbss shared OVAL to the install_hids rule

This rule is the only used of this "shared" OVAL.

On top of that the shared OVAL uses definitions from
the rule(s) of that group. Which is insane, and needs fixing,
but let's at least keep the insanity a bit more contained for
now.

linux_os/guide/system/software/integrity/endpoint_security_software/install_hids/oval/shared.xml

@@ -1,4 +1,16 @@
 <def-group>
+
+  <definition class="compliance" id="install_mcafee_hbss"
+  version="1">
+    {{{ oval_metadata("Install McAfee Host-Based Intrusion Detection Software (HBSS)") }}}
+    <criteria operator="AND">
+      <extend_definition comment="McAfee HBSS" definition_ref="install_mcafee_cma_rt" />
+      <extend_definition comment="McAfee HBSS" definition_ref="install_mcafee_hbss_accm" />
+      <extend_definition comment="McAfee HBSS" definition_ref="package_MFEhiplsm_installed" />
+      <extend_definition comment="McAfee HBSS" definition_ref="install_mcafee_hbss_pa" />
+    </criteria>
+  </definition>
+
   <definition class="compliance" id="install_hids"
   version="1">
     {{{ oval_metadata("Intrusion detection software or SELinux should be installed and enabled.") }}}