Add new type to support userns

[rhatdan]

No description provided.

[cgwalters]

My issue with this is...it's already really super confusing between Docker/Kube/OpenShift all of which have different security constraints. The fact that Kube/OpenShift don't do seccomp by default, but docker/podman does is probably the most confusing.

How this all interacts with SELinux is yet another mess.

Let me strawman this: If seccomp is disabled, then the container runtime should assume container_userns_t by default.

[cgwalters]

Similarly to how --privileged also changes to spc_t.

[rhatdan]

@cgwalters I was thinking more that podman would see that it is run by a non privileged user so it would use an alternate label. Not related to seccomp. I also think we need a way of using seccomp, but adding in the usernamepace syscall when run as non priv.