Apparmor

Apparmor profiles for sensu components plus sensu check for apparmor entries in the logfiles.
Can we have the class name and filename be closer?

I assume that the check is specific to how logstash stores data in ES, so `s/ElasticSearch/LogStashElasticSearch/` perhaps?