tests/kola/selinux: add test that policy isn't recompiled

This is a test for openshift/os#1036. It also
exists in the rpm-ostree CI, but let's have it here too since other
packages can break this.

tests/kola/selinux/default

@@ -0,0 +1,14 @@
+#!/bin/bash
+# kola
+#   exclusive: false
+#   # if it works on QEMU, it should work everywhere
+#   platforms: qemu
+
+set -xeuo pipefail
+
+. $KOLA_EXT_DATA/commonlib.sh
+
+if ostree admin config-diff | grep 'selinux/targeted/policy'; then
+    fatal "SELinux policy is marked as modified"
+fi
+ok "SELinux policy not marked as modified"