SELinux Policy: let custodia replicate keys
    
    Enhance the SELinux policy so that custodia can replicate sub-CA keys
    and certificates:
    allow ipa_custodia_t self:tcp_socket { bind create };
    allow ipa_custodia_t node_t:tcp_socket node_bind;
    allow ipa_custodia_t pki_tomcat_cert_t:dir remove_name;
    allow ipa_custodia_t pki_tomcat_cert_t:file create;
    allow ipa_custodia_t pki_tomcat_cert_t:file unlink;
    allow ipa_custodia_t self:process execmem;
    
    Found by: test_replica_promotion::TestSubCAkeyReplication
    
    Fixes: https://pagure.io/freeipa/issue/8488
    Signed-off-by: François Cami <fcami@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>