(PUP-3094) - Support for dynamic SELinux domain transition

Do not merge, this is for initial discussion.

Here is what we think is the best approach to allow dynamic transition into
target SELinux domains required for hardening master and ca processes as
discussed in

https://groups.google.com/forum/#!topic/puppet-dev/VTb2o-Nuxkw

This replaces wrappers which were proposed in

https://github.com/puppetlabs/puppet/pull/2997

Let me know if you like this approach in comments and I will go ahead and test
this (this is a draft really). Thanks. @domcleal