base: Label objects on the first boot and put SELinux in permissive

By default objects (files,processes,sockets) are not labeled with a
context, hence they don't have a type. This does not allow us to start
with SELinux set to Enforced the first time, so on the first boot
we label everything (touch /.autorelabel) not enforcing SELinux.
Later, the operator or the configuration management tool will
come and set SELinux to Enforced.