ostree-ext/store: client side SELinux labeling is not applied correctly on some cases.

spawned from: https://github.com/coreos/fedora-coreos-tracker/issues/2030

When a container image does not have derived content we might not apply the SELinux labels correctly when deploying.

This affects both rpm-ostree and bootc deployments as they share the [code path](https://github.com/bootc-dev/bootc/blob/main/crates/ostree-ext/src/container/store.rs#L1011).

As shown in https://github.com/coreos/fedora-coreos-tracker/issues/2030#issuecomment-3303980416 this occurs on bootc base images too, not only CoreOS builds.

To address this issue we should:
- [ ] create a bootc test similar to the CoreOS one running restorecon, also adding a stage that test with custom policy which we can add in the Containerfile directly. Then use that test to iterate.
- [ ] Investigate if forcing the same path of the image with derived layers on all images causes the issue to get fixed.