(maint) Do not turn off SELinux if it is already off

Without this patch the external CA acceptance tests is failing on EL
system which already have selinux turned off.  The `setenforce 0`
command returns nonzero when selinux is already disabled.  This patch
addresses the problem by only running `setenforce 0` if selinux is
enabled.