Document apparmor

I'm trying to fix our deployment script however @liushuyu it appears that by default apparmor is enabled, but it's not obvious at all what the settings are or how to fix it.

This post describes it best: https://www.reddit.com/r/openSUSE/comments/kanlom/phpfpm_is_blocked_by_apparmor/

Quoting:

> I saw no indication of AppArmor being an issue or having any involvement, and spent about 3 hours trying various FastCGI snippet options and PHP-FPM connection options, changing folder ownerships/permissions, and looking at logs. nginx was reporting that FastCGI was reporting permission denied, and nothing more specific than that. Not even 777'ing the entire folder fixed it.

One of the commenters says that they wasted 12 hours on this problem. I believe it.

For now, I'm using:

```bash
# TOGGLE OFF
sudo aa-complain /etc/apparmor.d/php-fpm
# TOGGLE ON
sudo aa-enforce /etc/apparmor.d/php-fpm
```

... but what does this even do? The above article says to use `sudo aa-logprof` to "Allow or deny whatever AppArmor would have blocked", but that seems a bit presumptuous without reviewing them.

I think reviewing syslog is the way:

```bash
sudo tail -f /var/log/syslog |grep audit
```

... but the events seem to vanish after `complain` has been toggled on and off. How do I actually allow these? Is there a procedure that isn't so esoteric?