AppArmor: bring back aliases for the read-write branch of the root filesystem, adjust the test suite accordingly

Since 3cdeadfe, the upper-dir (read-write
branch) of the overlayfs we mount on / is now exposed again, so to ensure
it does not provide alternative paths that would allow apps to access
files that AppArmor is supposed to block, we need to bring back the aliases
we previously had for aufs, modulo the read-write branch is now
/lib/live/mount/overlay/rw instead of /lib/live/mount/overlay.

Currently translated at 17.7% (11 of 62 strings)

Translation: Tails/wiki/src/news/version_3.14.1.*.po
Translate-URL: http://translate.tails.boum.org/projects/tails/wikisrcnewsversion_3141po/pt/

Currently translated at 39.0% (16 of 41 strings)

Translation: Tails/wiki/src/news/version_3.11.*.po
Translate-URL: http://translate.tails.boum.org/projects/tails/wikisrcnewsversion_311po/it/

I've uploaded Stretch's live-boot to our feature-buster APT overlay suite.
Let's install it and postpone finishing these adjustments. Accordingly, let's
revert our code to a state suitable for Stretch's live-boot.

This reverts commits 016e53e9,
4377f177,
99a01f8a,
df3c2dea,
928c868e
and 8b452697.

Ship a /etc/apparmor.d/tunables/home.d/tails snippet, instead of patching /etc/apparmor.d/tunables/home.

This should make our Tails-specific configuration easier to maintain and audit.