support selinux relabling APIs

[cgwalters]

Split from rhinstaller/anaconda#7236

Basically we have ~three types of data:

1. stuff in the ostree/composefs repo that should be immutable
2. /etc and /var
3. Other mounted partitions

I think we should offer APIs to perform relabeling of the first two. For the first, we already have bootc internals fsck that should handle stuff like this. I think that doesn't need to be run from the initramfs.

For the second, probably the simplest thing here is /etc/.autorelabel and /var/.autorelabel or so? I think semantically, these would not traverse mountpoints (see below).

For other mounted partitions, I think SELinux userspace in the initramfs should probably support something for this.