Fixes #3159: prevent AVC denials related to passenger interaction with the puppet_*_t and a couple other domains

In addition to the denials that this PR fixes, it also makes `foreman.sh` executable.