Always use the unknown permissions handling build option.

This compile-time feature is in the minimum-required checkpolicy/checkmodule
for building the policy, so it should always be used.
Add full RBAC-based role separation base pieces.

* Build option support
* Initial rbacsep constraints
* RBAC module for rbac exemption attributes.
Add RBAC setting in headers build.conf.
Merge branch 'master' of github.com:pebenito/refpolicy