security: implement apparmor profile

[ghost]

in restricting (docker-)process access to files and limit its capabilities, apparmor should become quite handy - more information about a relatively easy implementation:

https://docs.docker.com/engine/security/apparmor/

(thnx Alex for pointing out that link, https://duckduckgo.com/?t=ffab&q=docker+apparmor&ia=web would have also done the trick xD)

There are more approaches, a nice overview can be found here: https://security.stackexchange.com/questions/196881/docker-when-to-use-apparmor-vs-seccomp-vs-cap-drop