LXD and other applications using namespacing don't have direct access
to some of apparmor's interfaces within the container. Instead the
startup process or managing daemon are opening the fd and passing that
into the namespaced child.

Refactor libapparmor so that it can provide this functionality and
export it so LXD et al. don't have to role their own implementations.

Signed-off-by: John Johansen <john.johansen@canonical.com>