feat(profile): add support for terminal in flatpak app.

- Sandbox's security is managed by flatpak
- The app stays confined under the (not really strict) flatpak-app profile
- User shell runs unconfined (under the `user_unconfined` profile)

Running terminal as a flatpak app provides less security than as a normal app.
This is because the shell runs as user_unconfined profile that will purposely
not transition to any other profile. While a shell from a classic terminal will
transition to any profile it can, and thus would get restricted. In other words,
running `apt` inside flatpak would run under the `user_unconfined` while it
would use the `apt` profile outside the sandbox.

fix #314

apparmor.d/abstractions/common/app

@@ -37,6 +37,9 @@
         / r,
         /.* r,
         /*/ r,
+        @{bin}/ r,
+        @{lib}/ r,
+        /usr/local/bin/ r,
   owner /@{uuid}/ w,
   owner /_@{int}_/ w,
 
@@ -60,6 +63,7 @@
   @{run}/havahi-daemon/socket rw, # Allow access to avahi-daemon socket.
   @{run}/host/{,**} r,
   @{run}/pcscd/pcscd.comm rw, # Allow access to pcscd socket.
+  @{run}/utmp rk,
 
   @{sys}/ r,
   @{sys}/block/ r,
@@ -87,17 +91,22 @@
         @{PROC}/@{pid}/task/@{tid}/status r,
         @{PROC}/bus/pci/devices r,
         @{PROC}/driver/** r,
+        @{PROC}/pressure/cpu r,
+        @{PROC}/pressure/io r,
+        @{PROC}/pressure/memory r,
         @{PROC}/sys/fs/inotify/max_user_watches r,
         @{PROC}/sys/kernel/core_pattern r,
         @{PROC}/sys/kernel/osrelease r,
         @{PROC}/sys/kernel/pid_max r,
         @{PROC}/sys/kernel/yama/ptrace_scope r,
         @{PROC}/uptime r,
+        @{PROC}/version r,
         @{PROC}/zoneinfo r,
   owner @{PROC}/@{pid}/clear_refs w,
   owner @{PROC}/@{pid}/comm rw,
   owner @{PROC}/@{pid}/fd/@{int} rw,
   owner @{PROC}/@{pid}/io r,
+  owner @{PROC}/@{pid}/loginuid r,
   owner @{PROC}/@{pid}/net/if_inet6 r,
   owner @{PROC}/@{pid}/oom_score_adj rw,
   owner @{PROC}/@{pid}/statm r,