Change dumpdir to /var/log/chrony in defaults
AppArmor profile on Debian prevents writing to /var/lib/chrony{/data}
from /etc/apparmor.d/usr.sbin.chronyd ... /etc/chrony/{,**} r, /{,var/}run/chronyd.pid w, /{,var/}run/chrony/{,} rw, /var/lib/chrony/{,} r, /var/lib/chrony/* w, /var/log/chrony/{,} r, /var/log/chrony/ w, ...