basic-pluto-01 but now with labeled IPsec using XFRM.

This installs a policy label that will be used to match
other policies. That is, an acquire happens per different
policy group, so the connection leads to many tunnels
each only different in their selinux SPD selector.

Now in enforced mode

