Avoid rbind /sys for chroot snap pre-seeding (cgroups fail to unmount)

Builds in LP with the Xenial kernel were happy with the recursive mount of
/sys inside the chroot while performing snap-preseeding but autopkgtests
with the groovy kernel failed.  With the groovy kernel the build was
unable to unmount sys/kernel/slab/*/cgroup/* (Operation not permitted).

This patch mounts /sys and /sys/kernel/security in the chroot in the
same way we've added for binary hooks.  This provides the paths under
/sys needed for snap-preseed while avoiding issues unmounting other
paths.

(cherry picked from commit 84397b5098)

live-build/auto/build

@@ -119,7 +119,8 @@ preinstall_snaps() {
 	fi
 
 	mount --rbind /dev chroot/dev
-	mount --rbind /sys chroot/sys
+	mount --bind /sys chroot/sys
+	mount --bind /sys/kernel/security chroot/sys/kernel/security
 	mount --bind /proc chroot/proc
 	# Provide more up to date apparmor features, matching target kernel
 	mount -o bind /usr/share/livecd-rootfs/live-build/apparmor/generic chroot/sys/kernel/security/apparmor/features