changehat AppArmor library as a PAM module

 This provides the PAM module needed to declare various differing
 confinement policies when starting PAM sessions by using the
 changehat abilities exposed through libapparmor.