Add internal SELinux policy overrides

In the future, this will likely include an ostree_t domain.  For now,
this is just a few additional allow rules.
libostree: Split off SELinux OstreeSePolicy class

It's better if this is independent from the OstreeSysroot; for
example, a policy is active in a given deployment root at once, not
for a sysroot globally.

We can also collect SELinux-related API in one place.

Unfortunately at the moment there can be only one instance of this
class per process.