unconfined: if "unconfined" can ptrace then it can ptrace all subjects
    instead of only "self"
selinux/unconfined: add setbool to secure_mode_policyload restriction
    enable secure_mode_policyload by default

    the idea is that i want subjects that have unconfined access to selinux assets
    to not be able to setbool (in memory) is secure_mode_policyload is true

    else these unconfined_subject() callers would be able to get around the ptrace
    restriction by just toggling unconfined_ptrace boolean
i still want to be able to disable setbool for callers of unconfined_subject()
    but this is not the way to do it

Revert "selinux/unconfined: add setbool to secure_mode_policyload restriction"

This reverts commit 6f273d1e4137ef29edbe4c495f06c63a0b2cd893.