feat(profiles): use /etc read only variable: etc_ro

apparmor.d/groups/gnome/gdm-session-worker

@@ -67,15 +67,15 @@ profile gdm-session-worker @{exec_path} flags=(attach_disconnected) {
   /usr/share/gdm/gdm.schemas r,
   /usr/share/wayland-sessions/*.desktop r,
 
+  @{etc_ro}/environment r,
+  @{etc_ro}/security/limits.d/{,*.conf} r,
   /etc/default/locale r,
-  /etc/environment r,
   /etc/gdm{3,}/custom.conf r,
   /etc/gdm{3,}/daemon.conf r,
   /etc/locale.conf r,
   /etc/machine-id r,
   /etc/motd r,
   /etc/motd.d/ r,
-  /etc/security/limits.d/{,*.conf} r,
   /etc/shells r,
 
   owner @{run}/user/@{uid}/keyring/control rw,