Add client API support for set-label

This API is very similar to set-value, but it handles access checks
differently. This action is most likely to be used through 'buxtonctl',
but there may be other (privileged) clients that need more fine-grained
control at runtime.
direct: forbid set-label for non-root clients

The proper check here is to inspect the clients' capabilities to ensure
they have CAP_MAC_ADMIN, but this is the difficult problem to solve in a
race-free way (PID exhaustion attack, etc.).

For now, we will check the client's UID and disallow set-label for
non-root clients. This does not account for situations where we have
connections from root clients without CAP_MAC_ADMIN or non-root clients
with the capability, but these situations are unlikely at present.

Also, fix two tests that are setting labels to account for the new UID
restriction.
cli: remove the --direct requirement for set-label

Now that the public API supports setting a label on a group or key, and
we check the client's credentials for this action instead, the --direct
option is no longer required for set-label.
test: add tests for the set_label API
direct: avoid Smack checks after the UID check for set-label

Add this point in the code, a root client is doing the get-value, so no
Smack checks are needed.
test: add test for set-label on a key