selinux: add policy rules for pmdanetcheck
selinux: add policy rules for pmdanetcheck

PMDA netcheck uses ping(1) to check the status of monitored
hosts, this requires new SELinux rules. It could be possible
to create a pure Python implementation which would only hit
the following (based on testing with rudimentary test code):

avc:  denied  { connect }
avc:  denied  { create }
avc:  denied  { net_raw }
avc:  denied  { setopt }

However, there seems to be no existing and maintained Python
module that would match ping(1) functionality and cases like
https://android.googlesource.com/kernel/tests/+/master/net/test/ping6_test.py
hint that having a reliable Python ping module might turn
into a more involved effort than the whole PMDA itself.

Using ping(1) the above connect AVC is not seen but these are
appearing instead:

avc:  denied  { execute }
avc:  denied  { execute_no_trans }
avc:  denied  { getopt }
avc:  denied  { map }
avc:  denied  { setcap }

This commit updates the PCP SELinux policy to allow these to
allow doing network checks by calling ping(1) from PMDA netcheck.

Ideally, these could be separated as per-PMDA booleans or rules
as per https://github.com/performancecopilot/pcp/issues/388 but
for the time being we use the same approach as before.

adfernandes/pcp,adfernandes/pcp,adfernandes/pcp,adfernandes/pcp,adfernandes/pcp,adfernandes/pcp,adfernandes/pcp,adfernandes/pcp