For primit apparmor requires that if target confinement does not match
the setting task's confinement, the setting task requires CAP_SYS_RESOURCE.

Unfortunately this was broken when rlimit enforcement was reworked to
support labels.

Fixes: 86b92cb7 ("apparmor: move resource checks to using labels")
Signed-off-by: NJohn Johansen <john.johansen@canonical.com>