Except the shell domain from the transition neverallow rule.

Shell domain can transition to other domains for runas, ping, etc.

Change-Id: If9aabb4f51346dc00a89d03efea25499505f278d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>