Use a hashtab to keep track of range_transitions and role_transitions

The hashtab lookups will increase performance when checking
for conflicts

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
Increase size of symtab for types to decrease number of collisions

Since there are no blocks in fedora policy, everything goes into root
symtabs. Increasing the types symtab in the root symtab allows all
types to fit.

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
Fix ordering issues with the in-statement

Previously, in statements were evaluated in the order in which they
appeared. However, in-statements can depend on the effect of other
in-statements, which causes ordering dependencies. For example:

  (block a)

  (in a.b
    (type t))

  (in a
    (block b))

In this case, if 'in a.b' is evaluated before 'in a', block b will not
yet exist and it will fail.

CIL must be order agnostic. So to solve this issue, during the 'in'
resolution pass, we gather up all in-nodes in a list. Once they have all
been gathered, we attempt to evaluate all in statements in the list.
Failures are allowed as long as at least one in statement succeeds. We
continue to try to evaluate all failed in statements until either they
all succeed or no further statements are evaluated, at which point it is
determined there is an error in the policy.

To allow for the above logic to work and not be too complicated, we must
disallow nesting of in-statements, so this patch also removes that
ability (as well as in-statements inside macros, which should never have
been allowed). This is not much of a restriction since nested
in-statements can always be rewritten as two separate in-statements. For
example, the following are equivilent:

  (in a
    (in b
      (type t)))

  (in a.b
    (type t))

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>