Hide SELinux policy during initramfs (#1044484)

There's at least three reasons that we shouldn't load policy during
initramfs:

1) Because initramfs doesn't have labels on any of its files, all
processes get "kernel_t" as their context. This can lead to nasty subtle
weirdness, including mislabeled files in /run.

2) Starting the old system while running the new policy could cause
other strange and subtle problems due to policy differences between the
two releases. It's really hard to predict where and how that might
happen.

3) If we load policy during initramfs, but the user has disabled SELinux
(or uninstalled it completely), current systemd will bail out because
SELinux is initialized, but it can't load labels.

A saner course of action would seem to be to let the system start as
it usually does (i.e.: no policy in initramfs, load policy when you
switch to the real root), and then load *new* policy when we switch-root
into UPGRADEROOT.

So. To accomplish this, we put the SELinux policy at /etc/selinux.hidden
(so it gets ignored during initramfs), but we move it back to its normal
path before the switch-root.

We also don't ship a SELinux config, but we copy whatever config the
system has. Thus the SELinux settings during the upgrade should match
the normal system's settings.