Make SELinux labels opt-in

[AkihiroSuda]

SELinux labels are unconditionally applied since the commit d9834f8 , but this seems pretty immature

• rootfs not labeled with SELinux mount label #2320
• Rootful BuildKit + SELinux: Dockerfile RUN command throws error code 139 containers/container-selinux#187
• BuildKit: denied { write } (scontext=system_u:system_r:container_t:s0:c23,c164 tcontext=unconfined_u:object_r:container_ro_file_t:s0) containers/container-selinux#190
• Support BuildKit (cont.) containers/container-selinux#193 (comment) (RUN --mount=type=secret fails)

The fixes are to come in the container-selinux, but not all users can install the latest container-selinux, and the hard-coded path information in the container-selinux policy files can be easily out of sync with the BuildKit implementation.

I suggest making SELinux labels opt-in.