apparmor: fix module parameters can be changed after policy is locked