Incorporate Ubuntu changes

This includes a few more upstream fixes and AppArmor related bits that are needed to get rid of the Ubuntu delta.

It also introduces a (slightly ugly) bit of code to debian/rules to apply an Ubuntu-specific patch when built on Ubuntu. That's needed as Ubuntu has a modified version of AppArmor which requires anything using the user namespace to be AppArmor confined using a new "userns" keyword.

As the goal is to have Ubuntu just be able to import the Debian package as is, that bit is made conditional under DEB_VENDOR.