feat(profile): more use @{etc_ro} when we know it is needed.

apparmor.d/profiles-m-r/newgrp

@@ -23,9 +23,9 @@ profile newgrp @{exec_path} {
 
   @{bin}/@{shells}     rUx,
 
-  /etc/{passwd,group,shadow,gshadow} r,
+  @{etc_ro}/login.defs r,
 
-  /etc/login.defs r,
+  /etc/{passwd,group,shadow,gshadow} r,
 
   owner @{PROC}/@{pid}/loginuid r,
 

apparmor.d/profiles-m-r/pwck

@@ -16,7 +16,8 @@ profile pwck @{exec_path} flags=(attach_disconnected) {
 
   @{bin}/nscd rix,
 
-  /etc/login.defs r,
+  @{etc_ro}/login.defs r,
+
   /etc/.pwd.lock wk,
   /etc/passwd rw,
   /etc/passwd.@{int} rw,