Apparmor

* Apparmor profile for logstash & friends
* Grok patterns for apparmor entries
This should already by shipped by rsyslog (which is setup) so we don't need to ship this file