SELinux: Various xfrm labeling fixes