More SELinux rework

Right now, selinux/ just adds some overrides for the Fedora base.  But
in the future we'll have a real ostree_t domain.

Also, add a public OstreeSePolicy API so that rpm-ostree can consume
the logic inside of here.