Selinux policy

**Depends on #579**

Implements our own selinux policy which we use in our integration tests.

We'll keep this up to date, updating the code as we go along, and then send fixes upstream as needed.

The policy looks like this:

 * cockpit-ws is the most restricted process
       - listens on the network
       - runs cockpit-session
       - connects to other hosts via ssh
       - reads some files in specific directories
       - not much else
 * cockpit-session is slightly restricted
       - but it runs a full PAM stack
       - transitions to user/group
       - runs cockpit-agent
 * cockpit-agent is totally unconfined
       - runs as the user
 * test-server is totally unconfined