apparmor: allow kvm-spice compat wrapper
apparmor: allow kvm-spice compat wrapper

'kvm-spice' is a binary name used to call 'kvm' which actually is a wrapper
around qemu-system-x86_64 enabling kvm acceleration. This isn't in use
for quite a while anymore, but required to work for compatibility e.g.
when migrating in old guests.

For years this was a symlink kvm-spice->kvm and therefore covered
apparmor-wise by the existing entry:
   /usr/bin/kvm rmix,
But due to a recent change [1] in qemu packaging this now is no symlink,
but a wrapper on its own and therefore needs an own entry that allows it
to be executed.

[1]: https://salsa.debian.org/qemu-team/qemu/-/commit/9944836d3

Signed-off-by: Christian Ehrhardt <48da28e2c2cd455d60e19b14c46925e20a3c5d5b@canonical.com>
Reviewed-by: Michal Privoznik <mprivozn redhat com>

jfehlig/libvirt,jfehlig/libvirt,zippy2/libvirt,libvirt/libvirt,crobinso/libvirt,nertpinx/libvirt,olafhering/libvirt,olafhering/libvirt,crobinso/libvirt,nertpinx/libvirt,olafhering/libvirt,crobinso/libvirt,nertpinx/libvirt,libvirt/libvirt,zippy2/libvirt,zippy2/libvirt,jfehlig/libvirt,olafhering/libvirt,nertpinx/libvirt,crobinso/libvirt,libvirt/libvirt,zippy2/libvirt,nertpinx/libvirt,libvirt/libvirt,jfehlig/libvirt