[tamnd]

Part of #540, item 4 (AppArmor, enforce mode). This PR adds the path rules of AppArmor.

What changes

• The VFS has the path hooks of lsm.c of Linux: path_mknod, path_mkdir, path_rmdir, path_unlink, path_symlink, path_link, path_rename, path_truncate, path_chmod and path_chown. It also has inode_getattr and file_truncate. The VFS calls them at the places where Linux calls them.
• AppArmor checks these operations, as the path hooks of apparmor/lsm.c. A denial gives EACCES and a record of the class file.
• An open with O_TRUNC truncates the file after the LSM check of the open, as do_open of Linux. Before, an open that an LSM denied truncated the file.
• The x86_64 getdents call, with the old linux_dirent records, as filldir of Linux. The readdir regression test uses it.
• tests/user/init.c checks that enforce mode denies a chmod, a truncate, a link, a rename, a mkdir, an rmdir, a symbolic link, a mknod and an unlink with EACCES, and that the kernel log has the records of Linux.

Tests

The AppArmor regression tests with tools/apparmor/run.py --enforce on server1, rukernel against Linux 6.8.0-147-generic (--linux):

Test	rukernel	Linux
open, openat, rw, pwrite, mmap, exec	pass	pass
link, link_subset, mkdir, rename, unlink, symlink, setattr	pass	pass
readdir	pass	pass

• Load average at the start of the first run 0.07, at the end 7.46. The readdir run started at load 0.18.
• cargo xtask boot-test apparmor on server2: pass (load 13.38 at the start, 21.61 at the end).
• RK_AARCH64_TESTS=apparmor cargo xtask boot-test aarch64 on server2: pass (load 14.56 at the start, 15.76 at the end).

The full gate did not run.