These are extremely useful when dealing with a limited serial
console to try to restore some order to the output.

We have a few issues right now where files in our images
don't have any selinux context (i.e. end up unlabeled_t).
Here we workaround the hidden mountpoints issue [1] with
a patch to OSBuild to hardcode some chcon calls. We
workaround the "bunch of files under /sysroot are unlabeled"
issue [2] by backported a proposed upstream change to
the org.osbuild.selinux stage [3] and then using it to
explicitly set the context on the root of the tree to
`root_t`. We also add a fix [4] for another issue where
'/boot/coreos/platforms.json' would end up with the
wrong label.

[1] coreos/fedora-coreos-tracker#1771
[2] coreos/fedora-coreos-tracker#1772
[3] osbuild/osbuild#1889
[4] osbuild/osbuild#1888

I'm writing a test that verifies files on the filesystem
in CoreOS machinges match the SELinux policy. Placing
kolet in `/var/home/core/kolet` with a `bin_t` context
is a violation of this. Let's use /usr/local/bin/. This
has the side effect of the file having the right `bin_t`
context as soon as it is created.

(cherry picked from commit b076a72)