Improve AppArmor profile:
 - Use @{multiarch} tunable instead of *-linux-gnu* - they are the same on my system, but using the global tunable is more robust/portable
 - Drop block_suspend capability because it requires Linux >= 3.5 and does not seem to be needed (as of my testing)
 - Allow access to libpthread and librt, extensive testing indicates it is sometimes needed (libsodium multithreading?)
 - Allow access to libsodium if it's installed in the system default path with multiarch support instead of just /usr/lib/ and /usr/local/lib