feat(profiles): use /etc read only variable: etc_ro

apparmor.d/profiles-a-f/atd

@@ -29,8 +29,8 @@ profile atd @{exec_path} {
   /{usr/,}bin/{,ba,da}sh    rix,
   /{usr/,}{s,}bin/sendmail  rPUx,
 
-  /etc/environment r,
-  /etc/security/limits.d/ r,
+  @{etc_ro}/environment r,
+  @{etc_ro}/security/limits.d/ r,
 
   /var/spool/cron/atjobs/{,*} rwl,
   /var/spool/cron/atspool/{,*} rwl,

apparmor.d/profiles-a-f/check-support-status-hook

@@ -119,7 +119,7 @@ profile check-support-status-hook @{exec_path} {
     owner @{PROC}/@{pids}/loginuid r,
           @{PROC}/1/limits r,
 
-    /etc/security/limits.d/ r,
+    @{etc_ro}/security/limits.d/ r,
 
           /tmp/ r,
     owner /tmp/debian-security-support.postinst.*/output w,