Add apparmor tests

Note that this expects logs to come via the kernel logging facility. Most of the time though we also deploy auditd and as a result the messages will come via /var/log/audit.log, so the test suite should be updated to test both cases