Make apparmor suck less with dconf and OpenAFS

- Allow unconditional read access to the OpenAFS cache, otherwise
  hilarity ensues with OpenAFS thinking the server went away.
- Allow read/write access to ANY dconf profile, not just the upstream one
  named "user"