CVE-2026-72460: apparmor: check label build before no_new_privs test

In the Linux kernel, the following vulnerability has been resolved:

apparmor: check label build before nonewprivs test

aachangeprofile() builds a replacement label with fnlabelbuildinscope() before the nonewprivs subset check. The build helper can fail and return NULL or an ERRPTR, but the result was passed to aalabelisunconfinedsubset() before the existing ISERRORNULL() check.

Reuse the existing target-label build failure handling immediately after the build. This preserves the current audit handling while preventing the subset helper from dereferencing an invalid label.