bottlerocket avc denial absence test

When running a normal container workload we want to check and make sure no selinux avc denials occur. This probably needs to be modeled as a workload test, and it cannot happen on the same node as a test that is checking that avc denials *do* occur (#433).

depends on:
- #419
- #429

Start by reviewing how workload tests are modeled and the dependency issues #419 and #429. Compare the intended absence check with the denial-producing test in #433, ensuring the two tests do not share a node. Done means a normal container workload verifies that no SELinux AVC denials occur.

Written by the indexing model from the issue text.