debathena-apparmor-config postinst interaction with apparmor incomplete

[kaduk]

rlink@… says:

Nickel version: You should ignore failures to restart apparmor, since
that can fail for reasons wholly unrelated to your package and leave
you with a half-installed package.

Ten-cent version: I introduced a systemd circular dependency into
CMUCS Dragon (the custom Ubuntu we run here) that would cause the
systemd apparmor.service to sometimes fail to start. And restarting
would fail, too.

Y'all test with apparmor_status before kicking off your restart, but
"apparmor_status --enabled" only reports if you *want* AppArmor?
to be running, not whether it *is*.