Merge lp://staging/~jamesh/thumbnailer/aa-access-fix into lp://staging/thumbnailer/devel

Move the AppArmor check earlier so it is not skipped for files already in the cache.

With the previous AppArmor changes, I moved the GetThumbnail() security check to the LocalThumbnailRequest::fetch() method. Unfortunately this method is not called if there is a cached version of the thumbnail, giving clients access to data they shouldn't have.

This branch renames the ThumbnailRequest::set_client_credentials() method to check_client_credentials(), and performs the access checks from within this method. This code path is always hit as part of the request, so avoids the problem.

Unfortunately, I can't easily check the AppArmor aspects from within the test suite since (a) AppArmor isn't available within the Jenkins environment, and (b) even if it was, it isn't clear what profiles we can rely on being loaded into the kernel.

Once I'm done with manual testing, I'll try to formulate this as something people can repeat in the test plan. The thumbnailer-admin utility is really useful here.