core: if Smack, mount some filesystems with default labels

If Smack is enabled, we should mount virtual filesystems
such as "/dev/shm" or "/run" with specific Smack labels.

Most notably, "/run" should have the "System::Run" label,
otherwise unprivilegied users will be unable to write to
it.

Change-Id: I81d4592e05382819a5c3615ce81419d3f17df38a
Origin: systemd@8552b17660033812080a11533bd0edce74401039
Origin: tizen@1798862c61e0573f550b94c699a885670133ccbb
Author: Auke Kok <auke-jan.h.kok@intel.com>
Author: Casey Schaufler <casey.schaufler@intel.com>
Signed-off-by: Manuel Bachmann <manuel.bachmann@open.eurogiciel.org>