neverallow read to shell- and app-writable symlinks.

To reduce the likelihood of malicious symlink attacks, neverallow
read access to shell- and app-writable symlinks.

Change-Id: I0dea1e6e4f0ce34531100696d230294e1b8a5500
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>