apparmor, tlsdate fix

- installs apparmor (will fail gracefully if we can't change the grub cmdline - e.g. on digitalocean)
- adds check that we're running at least kernel 3.5 before installing tlsdate