The only in-tree use of this is the DBus NixOS module, which always
passes apparmor (but the services.dbus.apparmor option defaults to
"disabled"). Set the default in the function as well so other users
of the function can take advantage of it.
(cherry picked from commit e9f45cc69d6fb2a2e2446ce9606eb7e9c376959f)