Release SELinux labels on error in init function.

[robbmanes]

This is a backport of an upstream fix for:

https://github.com/opencontainers/selinux/commit/fd7b61c28f9e134d36a5911eb1550f2704e4bf8e

Currently if we have an error in the options, we will leak and allocated SELinux label. This change will release on error.

Also return the mountlabel, even if the user specifies to disable SELinux separation. This keeps other containers from being able to look at this privileged containers content, as well makeing sure all content has a label.

This is in conjunction with https://github.com/projectatomic/docker/pull/370; while the leak isn't present as runc itself doesn't call this function as often as dockerd does, I thought it good to include.