Add a VERY basic deoccder for apparmor, and a couple of rules to
basically ignore things.
The IDs for the rules are in the user range, but that can change later.
Sample log message is from RealRancor on github #234. Hopefully he
can help expand the rules.
Update the decoder to add the operation. This seems important for
determining how malicious some action is.
Add arule to alert on DENIED messages.

The examples provided by @RealRancor illustrate an issue. The
original examples that were provided were in a syslog format
with "kernel" as the program_name. This made them identify as
iptables log messages. The DENIED examples did not have the syslog
header, and identified as auditd log messages. This work should
probably duplicate what was already done for auditd.
Add a couple of rules for breaking down the operations in the
DENIED log samples. I don't know how much value something like this
really has, but I don't have a lot of experience with apparmor.

On another note, but British may be right. Armour feels more right
than armor.
Merge branch 'apparmor' of https://github.com/ddpbsd/ossec-hids