Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs

With this set, a lot of dangerous operations (chroot, unshare, etc)
become a lot less dangerous because there is no possibility of
subverting privileged binaries.

Includes additional work to fix apparmor.

Patch taken from kernel.org, authored by
Andy Lutomirski <luto@amacapital.net>
John Johansen <john.johansen@canonical.com>

Change-Id: Ic34200e2d1a690a81c0e88a59926f81c805ee713