Refactor HostConfig and escape apparmor confinement

This pull request does two things:
- it refactors `HostConfig` to be a member of `Container`, instead of being passed along all over the place
- it probes for AppArmor, and if it is detected, it goes through extra steps to make sure that privileged containers are not subject to AppArmor restrictions.

Those steps are:
- automatically uses the "unconfined" profile when `-privileged` flag is specified;
- copy `lxc-start` to `lxc-start-unconfined` (in the graph root directory), to run lxc-start itself unconfined.
This works because AppArmor does security context transitions using path names (as opposed to SELinux which uses extended attributes, for instance).