OCP: deprecate and make opt-in the selinux custom policy

[ffromani]

on OCP, we need a custom selinux policy to grant RTE(/NFD) access to the podresources socket. Thanks to the latest fixes in the most recent container-selinux package, we can use now a different but very compatible selinux process context (container_device_plugin_t) which is very close to the permissions we need.

In addition, delivering a new custom selinux policy

1. requires a reboot to worker nodes, which is undesirable
2. requires cleanup on removal, which we don't, littering the worker nodes

so it's time to switch default and make the custom selinux policy available but opt-in.