Manually check apparmor_status

The apparmor systemd unit file simply calls an old SysV init script
to load AppArmor profiles. The init script exits and systemd has no
idea if it's still running or not. This causes Ansible to start
the apparmor unit each time the playbook runs, which breaks the
idempotency checks.

This patch checks the apparmor_status output directly to see what the
status of AppArmor actually is. If the module is loaded, then we
should not try to start AppArmor with the unit file again.

This patch also includes the updates from the openstack-ansible-tests
repository that were included in
https://review.openstack.org/#/c/488489/ so that the gate can be
unblocked.

Partial-Bug: 1710675
Change-Id: If253714d0ca4b5a3d324255751e6f6615ca75dde

Vagrantfile

@@ -36,6 +36,10 @@ Vagrant.configure(2) do |config|
     leap422.vm.box = "opensuse/openSUSE-42.2-x86_64"
   end
 
+  config.vm.define "opensuse423" do |leap423|
+    leap423.vm.box = "opensuse/openSUSE-42.3-x86_64"
+  end
+
   config.vm.define "centos7" do |centos7|
     centos7.vm.box = "centos/7"
   end