ws: Add SELinux policy for cockpit-ws to our test environment
test: Turn on selinux enforcing in our tests
test: Create test images with SELinux enabled and enforcing

We run in enforcing mode when not in maintain mode of running
our VMs
WIP: Disable vm-download in this branch
test: Pull audit messages and check that not unexpected
test: Ignore another journal message
ws: Implement a new selinux policy for cockpit-ws and cockpit-session

 * cockpit-ws is the most restricted process
   - listens on the network
   - runs cockpit-session
   - connects to other hosts via ssh
   - reads some files in specific directories
   - not much else
 * cockpit-session is slightly restricted
   - but it runs a full PAM stack
   - transitions to user/group
   - runs cockpit-agent
 * cockpit-agent is totally unconfined
   - runs as the user
ws: Add selinux unconfined policy for test-server

Fixes #200