BugLink: http://bugs.launchpad.net/bugs/1448912

__aa_update_replacedby needs the ns lock held, this is done for profile
load/replace/remove case and the label_update case but not when called
from the label merge paths.

NOTE: this is just a conceptal "fix", it can not be validly used as
      label_merge is called from atomic context and taking a mutex_lock
      may sleep.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>