Fix labelling on QEMU restore images

Even though QEMU does not directly open the saved image when
restoring, it must be correctly labelled to allow QEMU to
read from it because labelling is passed around with open
file descriptors.

The labelling should not allow writing to the saved image
again, only reading.

* src/qemu/qemu_driver.c: Label the save image when restoring
* src/security/security_driver.h: Add a virSecurityDomainSetSavedStateLabelRO
  method for labelling a saved image for restore
* src/security/security_selinux.c: Implement labelling of RO
  save images for restore

Fedora-patch: libvirt-qemu-save-restore-2.patch