am 043b9027: Confine watchdogd, but leave it permissive for now.

* commit '043b9027':
  Confine watchdogd, but leave it permissive for now.

watchdogd.te

 # watchdogd seclabel is specified in init.<board>.rc
 type watchdogd, domain;
-unconfined_domain(watchdogd)
-allow watchdogd rootfs:file entrypoint;
+permissive watchdogd;
+allow watchdogd rootfs:file { entrypoint r_file_perms };
+allow watchdogd self:capability mknod;
+allow watchdogd device:dir { add_name write remove_name };
+allow watchdogd watchdog_device:chr_file rw_file_perms;
+# because of /dev/__kmsg__ and /dev/__null__
+write_klog(watchdogd)
+type_transition watchdogd device:chr_file null_device "__null__";
+allow watchdogd null_device:chr_file { create unlink };