security: full path option for DomainSetPathLabel
    
    virSecurityManagerDomainSetPathLabel is used to make a path known
    to the security modules, but today is used interchangably for
     - paths to files/dirs to be accessed directly
     - paths to a dir, but the access will actually be to files therein
    
    Depending on the security module it is important to know which of
    these types it will be.
    
    The argument allowSubtree augments the call to the implementations of
    DomainSetPathLabel that can - per security module - decide if extra
    actions shall be taken.
    
    For now dac/selinux handle this as before, but apparmor will make
    use of it to add a wildcard to the path that was passed.
    
    Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
    Signed-off-by: Michal Privoznik <mprivozn@redhat.com>