Add new audit_read access vector in capability2 class

This AV has been added in 3.16 in commit
3a101b8de0d39403b2c7e5c23fd0b005668acf48
Update Python requirement in INSTALL

PyXML has not been required to build the policy and its documentation
since at least Python 2.6, which comes with an "xml" module.

Moreover, some support scripts requires Python 2.6 or above (and are
compatible with Python 3.4, maybe also with other versions of Python 3).
Add the minimum supported version of Python in INSTALL.

ML thread: http://oss.tresys.com/pipermail/refpolicy/2014-November/007440.html
Merge upstream
Add upstream feedback when sent but needs some work
Move Portage bin definition to portage module (core filedefs can be in module in Gentoo)
Remove trailing space (messed up comparison with upstream)
Use same whitespace as upstream (better comparison)
Reshuffle to better match upstream
Match whitespace with upstream
Reshuffle to match upstream
Reshuffle to match upstream better (for comparisons)
Reshuffle to match upstream
Bad whitespace but matches upstream
Remove ifdef distro, pwd lock is now part of upstream
Reshuffle and update with upstream
Whitespace according to upstream
OpenRC cgroup helper requires dac_override privilege

Managing and updating cgroups through the kernel-invoked openrc cgroup
helper has the helper run under root privileges, but accessing files
(reading mostly) that are owned by a different user.
make the gentoo release script a little more user-agnostic
Replace deprecated interfaces with the new one
Introduce userdom_manage_user_tmp_chr_files interface