SELinux MCS isolation

We're going to need to implement what Docker has now where we do MCS isolation. See:

https://github.com/opencontainers/runc/blob/90472aeb9e5d5ef2722581d7dfbb573ef74f07cc/libcontainer/selinux/selinux.go

The ugly part here is that basically the daemon maintains a global state of MCS labels that have been allocated. Without a daemon, we'd need to use some well-known shared state file (`/run/bubblewrap/selinux` ?)