selinux: rework selinux access check logic

a) Instead of parsing the bus messages inside of selinux-access.c
simply pass everything pre-parsed in the functions

b) implement the access checking with a macro that resolves to nothing
on non-selinux builds

c) split out the selinux checks into their own sources
selinux-util.[ch]

d) this unifies the job creation code behind the D-Bus calls
Manager.StartUnit() and Unit.Start().

src/core/dbus-timer.c

@@ -25,6 +25,7 @@
 #include "dbus-timer.h"
 #include "dbus-execute.h"
 #include "dbus-common.h"
+#include "selinux-access.h"
 
 #define BUS_TIMER_INTERFACE                                             \
         " <interface name=\"org.freedesktop.systemd1.Timer\">\n"        \
@@ -133,5 +134,7 @@ DBusHandlerResult bus_timer_message_handler(Unit *u, DBusConnection *c, DBusMess
                 { NULL, }
         };
 
+        SELINUX_UNIT_ACCESS_CHECK(u, c, message, "status");
+
         return bus_default_message_handler(c, message, INTROSPECTION, INTERFACES_LIST, bps);
 }