Escape apparmor confinement

This pull request does two things:
- it automatically uses the "unconfined" profile when `-privileged` flag is specified;
- it copies `lxc-start` to `lxc-start-unconfined` (in the graph root directory), to run lxc-start itself unconfined.
This works because AppArmor does security context transitions using path names (as opposed to SELinux which uses extended attributes, for instance).

Tested with @mzdaniel.