convert disabled logic to handle enforcing<->permissive

I feel bad about this PR. It no longer achieves what I need, but it's still nice to have perhaps.

So this allows dynamically transitioning between enforcing and permissive.

The unless parameter will prevent the exec from running on machines where we're already in the desired state, or we're in disabled state and as such can't dynamically move into any other state anyway.