platform: enable enforcing mode SELinux earlier

[tormath1]

In this PR, we enable SELinux in enforcing mode earlier in the boot. Previously, it was done once the instance booted by running sudo setenforce 1.

By enabling and running all the tests with enforcing mode set as soon as possible during the boot, we'll be able to catch early denial from SElinux (like this one: flatcar-archive/coreos-overlay#1426) which can prevent Flatcar to behave correctly.

How to use

$ ./build kola
$ sudo ./bin/kola spawn --qemu-image ./flatcar_production_qemu_image.img
[bound] core@localhost ~ $ getenforce
Enforcing
[bound] core@localhost ~ $ sestatus
SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             mcs
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33

Testing done

⚠️ this needs to be merged after flatcar-archive/coreos-overlay#1426 otherwise all tests using Docker runtime will fail with:

$ sudo ./bin/kola run --qemu-image ./flatcar_production_qemu_image.img docker.base
=== RUN   docker.base
=== RUN   docker.base/docker-info
=== RUN   docker.base/resources
=== RUN   docker.base/networks-reliably
=== RUN   docker.base/user-no-caps
--- FAIL: docker.base (20.79s)
    --- FAIL: docker.base/docker-info (0.13s)
            docker.go:573: could not get dockerinfo: Process exited with status 7
    --- FAIL: docker.base/resources (0.58s)
            cluster.go:117: The program docker is managed by torcx, which did not run.
...

with the patch proposed in flatcar-archive/coreos-overlay#1426; it works fine:

$ sudo ./bin/kola run --qemu-image ./build/images/amd64-usr/developer-latest/flatcar_production_qemu_image.img docker.base
=== RUN   docker.base
=== RUN   docker.base/docker-info
=== RUN   docker.base/resources
=== RUN   docker.base/networks-reliably
=== RUN   docker.base/user-no-caps
--- PASS: docker.base (188.63s)
    --- PASS: docker.base/docker-info (1.28s)
    --- PASS: docker.base/resources (6.84s)
            cluster.go:117: WARNING: Your kernel does not support OomKillDisable. OomKillDisable discarded.
            cluster.go:117: WARNING: Specifying a kernel memory limit is deprecated and will be removed in a future release.
            cluster.go:117: WARNING: Your kernel does not support kernel memory limit capabilities or the cgroup is not mounted. Limitation discarded.
            cluster.go:117: WARNING: Your kernel does not support memory swappiness capabilities or the cgroup is not mounted. Memory swappiness discarded.
    --- PASS: docker.base/networks-reliably (157.16s)
    --- PASS: docker.base/user-no-caps (1.07s)