apparmor: unpack transition table if dfa is not present

[ Upstream commit e0ff0cff1f6cdce0aa596aac04129893201c4162 ]

Due to a bug in earlier userspaces, a transition table may be present
even when the dfa is not. Commit 7572fea3
("apparmor: convert fperm lookup to use accept as an index") made the
verification check more rigourous regressing old userspaces with
the bug. For compatibility reasons allow the orphaned transition table
during unpack and discard.

Fixes: 7572fea3 ("apparmor: convert fperm lookup to use accept as an index")
Signed-off-by: Georgia Garcia <georgia.garcia@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>