smack: use existing Smack label on key modify

The motivation for separating the set access checks into "set" and
"modify" is that the "modify" case is special:

If a key is modified, the existing Smack label from the key should not
change. In the "set" case, a default Smack label is set for the new key.
util: introduce a cleanup function for BuxtonData
Start using the BuxtonData cleanup function