Set the SELinux label for .container.init

Forthcoming builds of docker-io may run docker with --selinux-enabled,
so bind mounts need to be labeled correctly in order for the container
to be able to access them.

Set the label for .container.init to
system_u:object_r:svirt_sandbox_file_t:s0.

An alternative fix is to automatically relabel the volume if it was
mounted with the :Z flag - see
https://github.com/rhatdan/docker/compare/selinux.