Fix bad /lib /lib64 symlink context specs

/sys/fs/cgroup is a special case (probably systemd related)
Whatever resets the context of /sys/fs/cgroup from tmpfs_t to cgroup_t
hopefully does the same for symlinks inside /sys/fs/cgroup/.*
Turns out that whatever resets the context of /sys/fs/cgroup does not
catch the symlinks inside (i think lsetfilecon selinux function catches
symlinks)
We need the ldconfig domain for privileged processes (it needs to be
able to create /etc/ld.so.cache, and /etc/ld.so.preload)

Unprivileged processes should execute ldconfig in the caller domain
If you arent either domain or invalid_t than invalid_t or domain can
never mess with your process

If you arent either domain or invalid_t then you can never mess with
anyones process
Implement unconfined_execmod boolean: conditionally allow unconfined
domains to execmod all file types
Unconfined domains cannot setsched of other domains, except system_t but
only if secure_mode_insmod is unset

Might want to undo this commit
layout improvement