[apparmor] default profile

[John Johansen]

so one more issue around this

the current proc attr interface doesn't specify a mode for a profile with the name of unconfined.

Should we retain this behavior?
- for any profile that is unconfined?
  - same for compound labels, with all labels in the unconfined mode?
- for just profiles that are named unconfined and in the unconfined mode?
- do not retain this behavior?