Fix: allow CIPSO labels with zero categories

commit 4e4ea9142727ca7f14bf1d64cd81949b28bb1d0b mainline

There was false restriction in smack_cipso_add_from_file() that
disallowed CIPSO labels without categories.

For example, this example given in the SMACK kernel documentation
should be perfectly legal:

TopSecret 7