It is quite a bit more picky and failed to load profiles with:

  profile has merged rule with conflicting x modifiers
  ERROR processing regexs for profile sanitized_helper, failed to load

Looking at it closely, one realizes that it's totally correct, and our previous
adjustments were incomplete.

This change includes re-diff'ing so that this patch applies cleanly against
the profiles shipped by apparmor 2.9.0-3~bpo70+1 (uploaded to our APT overlay
for this branch, but not to Debian yet).