ab update: Trident tries to relabel shared partitions too when selinux is being used

On AB update when SELinux is being used, Trident generates a list of all filesystems that must be relabeled. This list includes shared partitions, not only inactive volumes. This leads to a situation where we relabel active filesystems too. This generally doesn't case issues, but it may cause intermittent failures when incompatible processes are running and operating on the active OS.

An example of this is containerd, which manages many filesystem trees, overlays, and mounts in /var/lib/containerd. Past error reports have shown that setfiles may encounter issues and fail when it tries to relabel continerd-managed paths.

Start by tracing the AB update path that generates the SELinux relabel list, then inspect how shared partitions and inactive volumes are selected. Use the setfiles and containerd paths described in the issue as the failure context. Done means active filesystems, including shared partitions, are not included in relabeling during an AB update.