initial java
    java should be treated as an interpreter
    if you are a java client subject then you will need
    the permissions associated with is_java_client_subject
java: some more rules for is_java_client_subject
initial fop
    basically a simple test for java client subject policy
fop/java
    this should give me a rough idea of what java client subjects
    might all have in common

    its basically the same idea as pa_client_subject (pretty complex)

    fop depends on java but java does not depend on fop
    so callers of the fop role are also callers of java role

    since user subjects are not java client subject (it would conflict
    with my java tmp content solution) they are allowed to manage/relabel
    java home and tmp content from within the block that has the java role call
joe: remove comment, i mentioned it in the commit message