use upstream init code and make the systemd service independent from the initscript

This fixes https://bugs.debian.org/870697 by implementing the plan outlined in !6 (comment 29153).

The debian/patches/rc.apparmor.functions-*.patch come straight from my upstream MR: https://gitlab.com/apparmor/apparmor/merge_requests/252. The following commits port all our packaging to this upstream code and drop as much of our own as possible.

Notes:

• I've kept the bits about containers in the Debian/Ubuntu delta and there's now a second copy of this code. That could be refactored and upstreamed by someone who cares strongly about these use cases (and can easily test them) but I'd rather not block on this here.
• In the end, with all patches applied, /lib/apparmor/apparmor.systemd is very similar to our custom initscript. This could be refactored but since I don't test SysV code paths anymore, I won't do it myself.