Grant the browser read access on its profile directory.

For some reason, it now needs this to work properly. Given we already grant it
write access to all child files and directories, this seems to make sense.
AppArmor: include the fonts abstraction in the start-tor-browser profile.

Otherwise, when it runs zenity, fonts are garbled (each char is replaced with
a square) on current Debian sid.
AppArmor: include the freedesktop.org abstraction in the start-tor-browser profile.

It now needs access to /usr/share/pixmaps/.
AppArmor: allow start-tor-browser read access on dash.

We already do this for most other executable files start-tor-browser runs.
No idea why it used to work without this permission, but oh well, it now
needs it.
AppArmor: allow start-tor-browser to read /usr/share/zenity/zenity.ui.

When start-tor-browser runs zenity (under the start-tor-browser confinement),
unsurprisingly that one needs to read its own files. On current Debian unstable,
this includes /usr/share/zenity/zenity.ui.
Merge pull request #133 from intrigeri/apparmor-3

Apparmor profiles update (take 3)