Add AppArmor profile to contrib. It's useful for further lockdown that's impossible for the binary to do by itself, e.g. disallowing things like ptrace().
It's rather generous on file and library access since cjdns drops the file limit to 0 anyway, but it still won't let cjdroute access things it has no business with, like /tmp, /home /bin even if that limit is somehow circumvented.