AppArmor kernel patches for 5.x kernels

[jdstrand]

I gave a recent status update here: Snapd STILL requires out-of-tree apparmor patches for strict confinement.