xen: avoid installing flask policy file as '/boot'

Upstream patch to fix race condition between creating /boot and
installing the XSM policy. Race would cause policy to be written
to /boot instead of into the /boot directory if it didn't already
exist.

Signed-off-by: Philip Tricca <flihp@twobit.us>
build xsm policy when 'xsm' DISTRO_FEATURE is present

This pulls in a dependency on the checkpolicy compiler (native)
and adds --enable-xsmpolicy in do_configure when 'xsm'
DISTRO_FEATURE is present.

Signed-off-by: Philip Tricca <flihp@twobit.us>
Add note about dependency on meta-selinux to README.

Signed-off-by: Philip Tricca <flihp@twobit.us>