composefs: Add selinux policy finalization

[cgwalters]

Something like ostreedev/ostree#2569 also cc ostreedev/ostree#3649

There's a lot of nontrivial code related to this in ostree using bwrap etc - would need some design discussion to apply here

[cgwalters]

@cgwalters-bot take a look on a spike for this one

[cgwalters-bot]

Spike done: this ports cleanly and is simpler than ostree's. Right after the /etc merge in composefs-finalize-staged, we mount the staged EROFS, chroot into it with the existing ChrootCmd (no bwrap) with the merged /etc bound over it, and run semodule -N --refresh. systemd loads the policy from the deployment's state /etc after switch-root, so nothing in the UKI or the sealed EROFS changes.
PoC with a new tmt test (a local module plus a policy change in the new image, across a bootc switch): it passes on composefs (grub/BLS, unsealed) and ostree, and fails on current main, where the new image's policy is silently dropped. cgwalters-forge#31
Like ostree, the PoC treats a refresh failure as fatal, which is the ostree#3563 wedge risk. Design, options and open questions (mainly that failure policy and a stage-time check): https://gist.github.com/cgwalters-bot/7fa03dcf6c3866961aed7d5199366aaa

Generated-by: https://github.com/cgwalters/#llms