Enumerate root directories in apparmor profile

[aerusso]

Replace opaque character class with an explicit list of root-level directories to be granted access.

The replaced line in the apparmor profile deceptively granted access to all root-level directories that did not start with the letters any of the characters coprsy,^, which is probably not what was intended.

Once apparmor supports the proposed addition, this line can be replaced with {**^sys,proc}, which is what (I am guessing) was intended.

I'm currently running with this rule loaded. Other tools may need more liberal permissions. Notice that this adds access to opt and srv, which previously would not have been whitelisted.

[startx2017]

Works for me, thanks.