Implement confinement of the Android container via AppArmor

The used profile is derived from what LXD uses to confine its
containers. See https://github.com/lxc/lxd/blob/master/lxd/apparmor.go

scripts/container-manager.sh

@@ -38,6 +38,9 @@ start() {
 	# liblxc.so.1 is in $SNAP/lib
 	export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:$SNAP/lib
 
+	# Load the profile for our Android container
+	$SNAP/sbin/apparmor_parser -r $SNAP/apparmor/anbox-container.aa
+
 	exec $AA_EXEC $SNAP/bin/anbox-wrapper.sh container-manager \
 		--data-path=$DATA_PATH \
 		--android-image=$ANDROID_IMG \