Look into providing a finer grained control for allowing user-namespace generation

```
Effectively today we are defaulting to "all" and can't change that default in the SELinux policy
without some way to opt into the old behavior.

To do this I think we'd want a setting, like `settings.kernel.allow-user-namespaces`, with two or three values:
* "all" - all processes are allowed to create user namespaces
* "privileged" - privileged processes are allowed to create user namespaces
* "trusted" - trusted processes are allowed to use create namespaces

Then we would conditionally load an SELinux module based on which field was set.

We would then set `user.max_user_namespaces` up from zero by default and rely on the setting to restrict or allow access as needed.

I don't think it has to happen now but it would be a nice way to let people opt into more fine-grained access to user namespaces.
```
_Originally posted by @bcressey in https://github.com/bottlerocket-os/bottlerocket/pull/3121#discussion_r1213393620_

This was brought up during kernel 6.1 enablement with the new selinux controls for `user_namespace`.