Add container_runtime_t type bounds container_t

This will allow --no-new-privs and SELinux to work together

Git-EVTag-v0-SHA512: 284d5397737a70773e08dec034b4b654aaa71564bdbefe6271ccf807accd6f9cd667b52e08c833de09d39100bc40961e0c3d01108c1d5a5a405d5fe93ecb2150

Fix labeling on /usr/bin/runc*

Git-EVTag-v0-SHA512: 3d1ff17dfe75cd4aa36513f0efb70a823e77aa2beab78e672f1fc1608f1ab66450c69eb6ace9fb9f8b16a99ca42f07f15442b3a550ac12c54791c68951f50ba8

More updates for ocid file labels.

Git-EVTag-v0-SHA512: dca40ce1debd3c11114220e4f0ef559c36f08f66c20ee28736698f50e168d95278b775384d580829f49cf409db737d7f6b1eca1537ddecbc76db51a81bc9e8b7

Update with new fixes labeling of ocid

Git-EVTag-v0-SHA512: 9a898baa750bcf6553e7c149540922a7eaf76ce2b6405995933dd22056d28684977382a63c332ec7f2f10a46d5b8cff1a9cdc5fbce30fd4b037fd1d09bafc536

Move container_t and container_file_t out of virt into container policy

We need more flexibility with this policy then relying on selinux-policy
master.