Refine container_runtime_t access

[d3vilbox]

On a normal system, the container runtime (e.g. docker or containerd) needs to have great power because you don't know what users want to do and you need it to just work. We don't have that same requirement. We know what users are going to do and so we can refine things down. So far I've found that container_runtime_t can:

• write to modules_object_t
• read proc_kcore_t
• manage etc_t
• write to unlabeled_t files
• write to fixed_disk_device_t