1125334 - Adds celery_t policy to constrain pulp_workers, pulp_resource_manager, and pulp_celerybeat

https://bugzilla.redhat.com/show_bug.cgi?id=1125334

This introduces a new selinux policy named pulp-celery which defines the celery_t label. The policy has been tested on EL6 and EL7 with sync+publish, bind/unbind, update, register/unregister, pulp-admin upload, and node functionality.

The spec file is reworked to deploy and remove both the pulp-celery policy in addition to the pulp-server policy. I've cleaned up the bash scripts also.

The EL7 environment needed a few policy statements that did not compile on the EL6 environment, so the selinux policy is adjusted just before compilation depending on the platform. EL7 gets some additional statements. You'll see this addition in the pulp.spec file.

I've deleted pulp-selinux.py which has no chance of working without much effort, and removed it from the developer docs. This selinux policy will not work with a dev setup, only with an RPM based layout.

It also updates the release notes for 2.5.0, and adds a note about the selinux changes.

> We agree that manage cert files needs to be investigated, but it's a separate issue which needs to be prioritized along with other work. The BZ states that these processes are unconstrained, and this PR addresses that. This statement is needed for pulp to run in Enforcing mode, so to remove or adjust this statement we would likely need to make adjustments in Pulp. Does that make sense?

I don't understand why you give up in advance. Your policy seems to be
fine, you only have three major issues which should be fixed from the
day one. You are almost there:

* discuss the certs and shell - this is dangerous to allow and opens up
new attack vectors

* do not allow to manage pids - create your own type (this is three
lines and some additional testing work)

* document the rules rather now - history shows that once a rule is in,
nobody will ever care documenting it and you already spent the time, you
should know the best why you added the rule

-- 
Later,
 Lukas #lzap Zapletal