Refactor HostConfig and escape apparmor confinement

Closes #1955 

I had to make a new PR, the rebase was awful.

@jpetazzo @crosbymichael @tianon  could you please re-test this quickly ?
@mzdaniel could you test this again, the `dind` files changed a lot, I did the rebase carefully, and remove all the FIXME, but please confirm.