Transform `user_list` into a product attribute (follow up from #8426)

[ggbecker]

Description of problem:

The jinja variable used by rules changed in #8426 should be transformed into a product attribute that can be overridden. Essentially this attribute can be a list and then processed by the build system to create the correct regex string to be used by the OVAL checks.

Some pointers in the code where to change:
https://github.com/ComplianceAsCode/content/blob/master/ssg/products.py#L38
https://github.com/ComplianceAsCode/content/blob/master/ssg/constants.py#L462-L463

[marcusburghardt]

@ggbecker , maybe this is no longer necessary after #10215 . What do you think?

[ggbecker]

Sounds reasonable.