this will fix the media errors on first reboot.

- Added basic sepolicy to allow device to boot (there's a bug that
  crashes the device without it)
- Added other sepolicies to fix denial and tighten processes
- Uses bind mount instead of symlink because file_contexts uses real
  path

Change-Id: I16628a9d4b8e1f66ccfc84df4adeee53eaf79bf9