Add apparmor UKI addon through sysupdate

Though not strongly required, this is needed for snapd to have proper confinement.

Our kernel has selinux by default (even though it is not active in runtime). But it is not stackable with apparmor. This addon allows to switch to apparmor.

/usr/lib/systemd/systemd-sysupdate --component=apparmor update

Then reboot.

Depends on:

• https://github.com/systemd/systemd/pull/29295
• !2386 (merged)