More AppArmor fixes for OCG.

This follows up on I026c374eadfd2b3623d7d11b3a8d82d17bcac49b -- AppArmor
actually requires a trailing slash on directory names (!).

Also added rw permission to /dev/tty, since our helper scripts check
whether stdout is a TTY before emitting colorized output on console.

Change-Id: I9088e22988e854c9266459bf0cb63ceb01341749