Check for it when we check for apparmor being enabled, rather
than doing it during the middle of a container setup.

This avoid the need to try mounting /sys and /sys/kernel/security
in the middle of startup, which we may not be allowed to anyway.
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Dwight Engen <dwight.engen@oracle.com>