certs: add missing dep & make apparmor optional

Add a missing dependency of /etc/ssl/localssl to the ssl-cert package
which actually creates both /etc/ssl and the ssl-cert group.

Also place the AppArmor conditionals under a Ubuntu if, as a) AppArmor
is specific to Ubuntu at this point b) there is code already to make it
fail() post-trusty so presumably there is something funky about it.
(the whole manifest is a bit of a mess anyway)

Change-Id: Iac1803639e67f715373bbf36d171714afc840980