feat(profiles): use /etc read only variable: etc_ro

apparmor.d/profiles-m-r/pkexec

@@ -61,9 +61,9 @@ profile pkexec @{exec_path} flags=(complain) {
   @{libexec}/cc-remote-login-helper rPx,
 
   /etc/shells r,
-  /etc/environment r,
+  @{etc_ro}/environment r,
   /etc/default/locale r,
-  /etc/security/limits.d/{,*} r,
+  @{etc_ro}/security/limits.d/{,*} r,
 
         @{PROC}/@{pids}/stat r,
   owner @{PROC}/@{pid}/fd/ r,