Include code and policy for AppArmor

[Doeme]

What this patch does is it includes a policy for AppArmor (inside a new dist/apparmor subfolder, which might not be correct) and it lets the process drop its privileges before processing requests, after all the bind(2)-ing and chroot(2)-ing etc. is done.

I'm also not sure whether it makes more sense to include this in the code-repo, or to distribute this as patches in e.g. portage.