apparmor: add #ifdef checks for secmark filtering