linux: add 'hardened' kernel with grsec+apparmor enabled