nixos: add AppArmor PAM support

Enables attaching AppArmor profiles at the user/group level.

This is not intended to be used directly, but as part of a
role-based access control scheme. For now, profile attachment
is 'session optional', but should be changed to 'required' once
a more comprehensive solution is in place.

nixos/modules/security/apparmor.nix

@@ -37,13 +37,5 @@ in
          ) cfg.profiles;
        };
      };
-
-     security.pam.services.apparmor.text = ''
-       ## AppArmor changes hats according to `order`: first try user, then
-       ## group, and finally fall back to a hat called "DEFAULT"
-       ##
-       ## For now, enable debugging as this is an experimental feature.
-       session optional ${pkgs.apparmor-pam}/lib/security/pam_apparmor.so order=user,group,default debug
-     '';
    };
 }