[BUG] selinux.fcontext_policy_is_applied doesn't check for errors, leading to silent failures to apply SELinux labels

Description
selinux.fcontext_policy_is_applied calls "restorecon -n -v" without checking for success. It returns lines of stdout which indicate actions restorecon would take, but when the command fails there are no lines of stdout, This means when you call it with a non-existent file, it will respond that the file is already correctly relabelled.

This function is called by the selinux.fcontext_policy_applied state, which silently fails when given a non-existent name.

The documentation states that the function supports regex syntax. This is potentially confusing. It supports shell globs, but not the regex syntax understood by "semanage fcontext". Using the same regex in selinux.fcontext_policy_present and selinux.fcontext_policy_applied will silently fail.

Setup

letsencrypt-well-known:
  selinux.fcontext_policy_present:
    - name: "/srv/letsencrypt(/.*)?"
    - sel_type: "httpd_sys_content_t"
letsencrypt-apply:
  selinux.fcontext_policy_applied:
    - name: "/srv/letsencrypt(/.*)?"
    - require:
      - letsencrypt-well-known

Steps to Reproduce the behavior
Apply above.

Expected behavior
/srv/letsencrypt/ is correctly relabelled.

Instead, the fcontext spec is correctly added, but restorecon is not run so the new label is not applied.

Versions Report
Salt Version:
Salt: 3003.1

Dependency Versions:
cffi: Not Installed
cherrypy: unknown
dateutil: 2.7.3
docker-py: Not Installed
gitdb: 2.0.5
gitpython: 2.1.11
Jinja2: 2.10
libgit2: Not Installed
M2Crypto: 0.31.0
Mako: Not Installed
msgpack: 0.5.6
msgpack-pure: Not Installed
mysql-python: Not Installed
pycparser: Not Installed
pycrypto: 2.6.1
pycryptodome: 3.6.1
pygit2: Not Installed
Python: 3.7.3 (default, Jan 22 2021, 20:04:44)
python-gnupg: Not Installed
PyYAML: 3.13
PyZMQ: 17.1.2
smmap: 2.0.5
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.3.1

System Versions:
dist: debian 10 buster
locale: UTF-8
machine: x86_64
release: 4.19.0-17-cloud-amd64
system: Linux
version: Debian GNU/Linux 10 buster

Additional context
Add any other context about the problem here.

Start with selinux.fcontext_policy_is_applied and the selinux.fcontext_policy_applied state, then compare their restorecon invocation with selinux.fcontext_policy_present and semanage fcontext behavior. Verify how command failures and shell-glob names are handled; done means nonexistent paths no longer report success and the documented naming behavior is accurate.