Support adding default kernel arguments, use enforcing=0 for now

We're quite close with SELinux, but let's not wait until we are
AVC-free before shipping.  Just use enforcing=0 for now.