daemon: Bind-mount /sys/fs/selinux into sysroot when running commands.

Even though we are already bind-mounting /sys, it is necessary to also
bind-mount /sys/fs/selinux in order for SELinux commands (in
particular, 'load_policy') to work.

This fixes/reverts commit 7367729ec7a5d016878dd00b32cce45cec372931.
builder: Add --selinux-relabel option to perform SELinux relabelling.

This adds the --selinux-relabel option which enables selinux in the
appliance and runs:

  if load_policy && fixfiles restore; then
    rm -f /.autorelabel
  else
    touch /.autorelabel
  fi

at the end of installation.

When possible this fixes SELinux labels in the guest and makes the
autorelabel step unnecessary.

Notes:

 - The previous commit is required so that load_policy works.

 - During the build, SELinux is enabled but no policy is loaded.  This
   works because SELinux is in permissive mode.

 - This flag does not work if the appliance kernel and the guest have
   greatly differing versions, eg. a RHEL 6 guest with a Fedora 20
   appliance.  This is because SELinux changes the policy format and
   breaks backwards compatibility.  You would see errors like this:

   libsepol.policydb_write: policy version 15 cannot support MLS
   libsepol.policydb_to_image: could not compute policy length
   libsepol.policydb_to_image: could not create policy image
   SELinux:  Could not downgrade policy file /etc/selinux/targeted/policy/policy.24, searching for an older version.
   SELinux:  Could not open policy file <= /etc/selinux/targeted/policy/policy.24:  No such file or directory

   These errors are ignored (they go to the log file) and relabelling
   is done at boot instead.

 - It's not clear if loading guest policy is safe.  You should trust
   the virt-builder templates and to use libguestfs confinement for
   additional protection.
builder: Add documentation for enabling Puppet (agent) in a guest.