AppArmor: bring back aliases for the read-write branch of the root filesystem, adjust the test suite accordingly

Since 3cdeadfe, the upper-dir (read-write
branch) of the overlayfs we mount on / is now exposed again, so to ensure
it does not provide alternative paths that would allow apps to access
files that AppArmor is supposed to block, we need to bring back the aliases
we previously had for aufs, modulo the read-write branch is now
/lib/live/mount/overlay/rw instead of /lib/live/mount/overlay.