Improve AppArmor profile

- Use @{multiarch} tunable instead of \*-linux-gnu\* - they are the same on my system, but using the global tunable is more robust/portable
- Drop block_suspend capability because it requires Linux >= 3.5 and does not seem to be needed (as of my testing)
- Allow access to libpthread and librt, extensive testing indicates it is sometimes needed (libsodium multithreading?)
- Allow access to libsodium if it's installed in the system default path with multiarch support instead of just /usr/lib/ and /usr/local/lib