Add support to checkpolicy/libsepol for -self (not self) in rules

[stephensmalley]

checkpolicy wrongly handles "-self". At the least, it should handle it as an error. At best, it should support it correctly (which would involve libsepol support as well). At present, it looks like it will end up negating (-) the next type/attribute in the list after self, or if there are no entries after self, ignoring it entirely.

[stephensmalley]

This originally was raised by the Android team, which wanted to support something like the following:
neverallow domain { domain -self }:dir search;
to prohibit cross domain access to some resource but allow access within the same domain.

[stephensmalley]

Changed checkpolicy to handle rules with -self as an error via commit 49bfee8
Leaving this issue open to explore supporting -self correctly in checkpolicy/libsepol.