Drop/adjust SELinux `install_t` testing

> SELinux: Context unconfined_u:object_r:invalid_bootcinstall_testlabel_t:s0 is not valid (left unmapped).

comes from https://github.com/bootc-dev/bootc/blob/03fa72b194070f6973451aeb52279957535567b0/crates/lib/src/lsm.rs#L50

Basically this is us trying to verify that we have the `install_t` capability, and some people (reasonably!) think this is an error or a problem.

To fix this what we need is a reliable mechanism to know if we have `mac_admin`. I believe via `/sys/fs/selinux` there's an API to dynamically query if a particular access would be allowed.

OK impressive I just clicked the copilot button in the web page on [the selinux git repo](https://github.com/SELinuxProject/selinux)) and it pointed me at [security_compute_av](https://github.com/SELinuxProject/selinux/blob/919e9e64cc4b20f5a1e4df1e38cce1bfe15aff09/libselinux/man/man3/security_compute_av.3#L86)) which looks right to me.

Though the next issue is Rust bindings; we'd need to do a review of [https://lib.rs/crates/selinux] as an option.