feat(profile): restrict some access to @{PROC}/@{pid}.

apparmor.d/groups/gnome/gnome-session-binary

@@ -91,9 +91,10 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
 
   @{sys}/devices/**/{vendor,device} r,
 
-        @{PROC}/@{pid}/cgroup r,
+        @{PROC}/1/cgroup r,
         @{PROC}/cmdline r,
         @{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
+  owner @{PROC}/@{pid}/cgroup r,
   owner @{PROC}/@{pid}/cmdline r,
   owner @{PROC}/@{pid}/fd/ r,
   owner @{PROC}/@{pid}/loginuid r,