1125334 - Adds celery_t policy to constrain pulp_workers, pulp_resource_manager, and pulp_celerybeat

https://bugzilla.redhat.com/show_bug.cgi?id=1125334

This introduces a new selinux policy named pulp-celery which defines the celery_t label. The policy has been tested on EL6 and EL7 with sync+publish, bind/unbind, update, register/unregister, pulp-admin upload, and node functionality.

The spec file is reworked to deploy and remove both the pulp-celery policy in addition to the pulp-server policy. I've cleaned up the bash scripts also.

The EL7 environment needed a few policy statements that did not compile on the EL6 environment, so the selinux policy is adjusted just before compilation depending on the platform. EL7 gets some additional statements. You'll see this addition in the pulp.spec file.

I've deleted pulp-selinux.py which has no chance of working without much effort, and removed it from the developer docs. This selinux policy will not work with a dev setup, only with an RPM based layout.

It also updates the release notes for 2.5.0, and adds a note about the selinux changes.

> It is for Pulp to function correctly. I believe this is related to the celery bootup process with upstart more than the pulp code inside of celery, but in either case it's required for correct operation. Feel free to file a bug on this as being a concern or policy defect.

Things in upstart will not require this as this is needed after the
transition into the final domain. It must be something in the pulp code
requiring shell.

And it may be fully valid, I just suggest you to find the code and see
if there is not other way.

For example we were not able to avoid it in foreman-proxy process.

-- 
Later,
 Lukas #lzap Zapletal