AppArmor: be more flexible on profile folders

We need to tell AppArmor that access to ~/.icedove is o.k. as well as
users will default getting now a symlink from ~/.thunderbird to
~/.icedove and the real profile is still in the old folder.

Thanks Matthias Geerdsen for the basic idea of the needed changes in the
AppArmor profile for TB.

Closes: #858735, #858737