nixos/apparmor: allow closure of selected mallocLib, fixes #125415

[ju1m]

Motivation for this change

Supporting environment.memoryAllocator.provider != libc by allowing all programs including the abstractions/base AppArmor profile to load the dependencies of the selected malloc library (and not only the library itself).
See #125415

Things done

• Add apparmorRulesFromClosure on mallocLib to the abstractions/base AppArmor profile.

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• 21.11 Release Notes
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[Izorkin]

Thanks, working!

[ju1m]

@SuperSandro2000 just a ping to be sure this fix is on your radar. It's ready to merge.

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-already-reviewed/2617/400

[aanderse]

Sorry @SuperSandro2000 I'm not familiar with apparmor enough to review this.