selinux, virt-handler: relabel the clone device
selinux, virt-handler: relabel the clone device

Depending on the host type, some files could need to be relabeled.
For instance, on coreOS, the files available on `/dev/...` are
labeled `system_u:object_r:container_runtime_tmpfs_t:s0`.

To enable virt-handler to create the tap devices without privilege
escalation, it will need to create the tap device using the
container_t based selinux label.

On coreOS, the label of the clone device must be reset to
container_file_t - within virt-handler - thus preventing the
following AVC when creating a tap device:

```
type=AVC msg=audit(1598344147.611:1088): avc:  denied  \
{ read write } for  pid=968934 comm="virt-chroot" \
name="tun" dev="tmpfs" ino=56743408 \
scontext=system_u:system_r:virt_launcher.process:s0:c434,c499 \
tcontext=system_u:object_r:container_runtime_tmpfs_t:s0 \
tclass=chr_file permissive=0
```

Signed-off-by: Miguel Duarte Barroso <c798d3f0e4fda7badfc3bbd91babde7ebd48b6c2@redhat.com>

kubevirt/kubevirt,kubevirt/kubevirt,davidvossel/kubevirt,kubevirt/kubevirt,stu-gott/kubevirt,davidvossel/kubevirt,stu-gott/kubevirt,davidvossel/kubevirt,davidvossel/kubevirt,stu-gott/kubevirt,kubevirt/kubevirt,stu-gott/kubevirt