Emulate dh_apparmor; drop apparmor-utils dependency

aa-enforce is shipped in apparmor-utils, use the underlying
`apparmor_parser` command provided by apparmor to enable the two
profiles.

This simplifies the dependency tree during the noble migration.
Switching to dh_apparmor properly (#7413) would be nice but is
a bigger task for later.

securedrop/debian/control

@@ -10,7 +10,7 @@ Package: securedrop-app-code
 Architecture: amd64
 Conflicts: libapache2-mod-wsgi, supervisor
 Replaces: libapache2-mod-wsgi, supervisor
-Depends: ${dist:Depends}, ${misc:Depends}, ${python3:Depends}, ${apparmor:Depends}, apache2, apparmor-utils, coreutils, gnupg2, libapache2-mod-xsendfile, paxctld, python3, redis-server, securedrop-config, securedrop-keyring, sqlite3
+Depends: ${dist:Depends}, ${misc:Depends}, ${python3:Depends}, ${apparmor:Depends}, apache2, coreutils, gnupg2, libapache2-mod-xsendfile, paxctld, python3, redis-server, securedrop-config, securedrop-keyring, sqlite3
 Description: SecureDrop application code, dependencies, Apache configuration, systemd services, and AppArmor profiles. This package will put the AppArmor profiles in enforce mode.
 
 Package: securedrop-config

securedrop/debian/securedrop-app-code.postinst

@@ -291,8 +291,9 @@ case "$1" in
         rm /etc/apparmor.d/disable/usr.sbin.apache2
     fi
 
-    aa-enforce /etc/apparmor.d/usr.sbin.tor
-    aa-enforce /etc/apparmor.d/usr.sbin.apache2
+    # Emulate what dh-apparmor does
+    apparmor_parser -r -T -W /etc/apparmor.d/usr.sbin.tor
+    apparmor_parser -r -T -W /etc/apparmor.d/usr.sbin.apache2
 
     # Munge Apache config while service is stopped.
     adjust_wsgi_configuration