Verify apparmor is enabled in appVMs

[legoktm]

Largely as a quirk of packaging, installation of the securedrop-client package in the template would fail if apparmor was not enabled. As of freedomofpress/securedrop-client#1856 this hard requirement has been removed and it'll no longer fail if apparmor is disabled.

But that check wasn't as useful as it could've been because it only verified apparmor was enabled in the template and not in the actual appVM. So we should have some sort of check that apparmor is enabled in enforcing mode in the appVMs we expect it in. A solution might be part of #939.