[tamnd]

Part of #540, item 4 (AppArmor, enforce mode). This PR adds the capability rules of AppArmor.

What changes

• AppArmor checks the capabilities, as capability.c of Linux. A capability that the profile does not allow gives EPERM and a record of the class cap. The rules audit and quiet work, and a repeated record is not written again, as the cache of capability.c.
• Each check of a capability calls the capable hook of the security modules after the check of the capability module. This is also true for a check in a user namespace and for the checks of a file, as ns_capable and capable_wrt_inode_uidgid of Linux.
• AppArmor finds the parent of a hat that has the name of a program, as aa_split_fqname of Linux. In P///bin/x the parent is P and the hat is /bin/x. Before, the parent was P/, so a change_hat from that hat to a sibling hat gave ECHILD.
• tests/user/init.c checks that enforce mode denies chroot and sethostname with EPERM, and that the kernel log has the records of Linux.

Tests

The AppArmor regression tests with tools/apparmor/run.py --enforce on server1, rukernel against Linux 6.8.0-147-generic (--linux):

Test	rukernel	Linux
capabilities	pass	pass

• The capabilities test ran on the kernel of the full AppArmor stack (this PR and the next ones). Load average 0.18 at the start, 1.38 at the end. The test takes 13029 s under TCG.
• cargo xtask boot-test apparmor on server2: pass (load 23.87 at the start, 17.31 at the end).
• RK_AARCH64_TESTS=apparmor cargo xtask boot-test aarch64 on server2: pass (load 14.56 at the start, 15.76 at the end).

The full gate did not run.