interfaces/builtin: add exec "/bin/runc" to docker-support

Newer runC applied further improvements to their CVE-2019-5736 mitigation in opencontainers/runc#1984 which change the nature of our apparmor denial from `/` to `/bin/runc` (which I have also commented on https://bugs.launchpad.net/apparmor/+bug/1820344 about).

See also #6610.

Signed-off-by: Tianon Gravi <tianon@debian.org>

interfaces/builtin/docker_support.go

@@ -156,6 +156,7 @@ ptrace (read, trace) peer=docker-default,
 
 # needed by runc for mitigation of CVE-2019-5736
 # For details see https://bugs.launchpad.net/apparmor/+bug/1820344
+/bin/runc rix,
 / ix,
 `