Mount selinuxfs read-only and on new location when possible

We need to mount the selinuxfs read-only inside the chroot to make the
userspace think that selinux is disabled. This is required, otherwise
dpkg will fail as no policy is installed in the chroot.

We are also moving the mountpoint of the selinuxfs from /selinux to
/sys/fs/selinux if the /selinux directory is not present on disk. This
directory has been removed in jessie.
Add debian/changelog entry for Laurent Bigonville's patch addressing #682068.