Have CI job run client under apparmor

[emkll]

As noted in https://github.com/freedomofpress/securedrop-debian-packaging/pull/105#issuecomment-566137365 , we should:

1. ~~Add an item in this repo's GitHub PR template to ensure the AppArmor profile is updated in the packaging ero if securedrop-client interacts with a new file~~ DONE
2. Create a CI job that will start the built client with the apparmor profile enabled

[eloquence]

Poking at template update now.

[redshiftzero]

Running the functional tests with the AppArmor profile in enforce mode would definitely help us catch issues

[zenmonkeykstop]

Will pick this up as something we can reasonably implement on the new Workstation CI setup.