jf: sepolicy: fix more denials

* sepolicy is a never ending mess

Change-Id: I4b33ca90d0808a0b4263e4e8adf0d77ab4b70d7b
sepolicy: mount firmware partitions with firmware_file context

* we don't need to give ueventd and mdm_helper access across the
  entire vfat context

Change-Id: Ie50be652d40e87f09f8becc8b33aed472ad54d76
jf: update extract-files

Change-Id: I27e058039f190101158baa820bf7b3a69e1ae76f