sepolicy: add some more policies

* more access to kcal and vibe devices
* allow kernel to unmount labeledfs (for new kernel)
* allow system_server access to time_daemon

Change-Id: I113c14014dde97c7f3c65c8afa60d979b02fcf98