Compile SELinux policies at Image Creation Time

Currently Bottlerocket's [SELinux policies](https://github.com/bottlerocket-os/bottlerocket/tree/a1d20d0598865a86f2328f292bcd60e562f90704/packages/selinux-policy) are written using the CIL intermediate language and then [compiled into a policy binary when the RPM is built](https://github.com/bottlerocket-os/bottlerocket/blob/a1d20d0598865a86f2328f292bcd60e562f90704/packages/selinux-policy/selinux-policy.spec#L52).

This means that out-of-tree changes to the policy effectively require a fork of the policies. We should consider an approach that allows arbitrary addition of new policies.

One idea:
* Allow any RPM to drop CIL files (should we support other representations?) in a directory in the resulting RPM
* The image build (during rpm2img) scans this directory in RPMs to discover SELinux policies
* These policies are compiled and installed during the image build step

Read packages/selinux-policy/selinux-policy.spec and the rpm2img image-build entry point; trace how the existing CIL is compiled and installed. Define and validate an approach that discovers CIL files from RPMs, compiles them during image creation, and permits arbitrary additional policies.

Written by the indexing model from the issue text.