apparmor: Allow slave bind mounts

This fixes the AppArmor policy for systems which configure shared subtree mounting by default (such as systemd). See https://launchpad.net/bugs/1325468 for details.