bottlerocket avc denial test

We want to try nefarious things in an unpriviledged container an make sure selinux blocks them. This cannot happen at the same time as #432

depends on:
- #419
- #429

Review dependencies #419 and #429 first, and account for the issue's incompatibility with #432. The task is to add a test that attempts unsafe actions from an unprivileged container and verifies SELinux denies them; the specific actions and test location are not identified here.

Written by the indexing model from the issue text.