ipaclient: Enable SELinux for SSSD

This is "ipa-client-install: enable SELinux for SSSD"
https://github.com/freeipa/freeipa/pull/6978 for ansible-freeipa:

For passkeys (FIDO2) support, SSSD uses libfido2 library which needs
access to USB devices. Add SELinux booleans handling to ipa-client-install
so that correct SELinux booleans can be enabled and disabled during
install and uninstall. Ignore and record a warning when SELinux policy
does not support the boolean.

Fixes: https://pagure.io/freeipa/issue/9434

roles/ipaclient/library/ipaclient_setup_nss.py

@@ -152,6 +152,10 @@ options:
       The dist of nss_ldap or nss-pam-ldapd files if sssd is disabled
     required: yes
     type: dict
+  selinux_works:
+    description: True if selinux status check passed
+    required: false
+    type: bool
   krb_name:
     description: The krb5 config file name
     type: str
@@ -189,7 +193,7 @@ from ansible.module_utils.ansible_ipa_client import (
     CalledProcessError, tasks, client_dns, services,
     update_ssh_keys, save_state, configure_ldap_conf, configure_nslcd_conf,
     configure_openldap_conf, hardcode_ldap_server, getargspec, NUM_VERSION,
-    serialization
+    serialization, configure_selinux_for_client
 )
 
 
@@ -224,6 +228,7 @@ def main():
             no_dns_sshfp=dict(required=False, type='bool', default=False),
             nosssd_files=dict(required=True, type='dict'),
             krb_name=dict(required=True, type='str'),
+            selinux_works=dict(required=False, type='bool', default=False),
         ),
         supports_check_mode=False,
     )
@@ -274,6 +279,7 @@ def main():
     options.sssd = not options.no_sssd
     options.no_ac = False
     nosssd_files = module.params.get('nosssd_files')
+    selinux_works = module.params.get('selinux_works')
     krb_name = module.params.get('krb_name')
     os.environ['KRB5_CONFIG'] = krb_name
 
@@ -474,6 +480,9 @@ def main():
             logger.info("%s enabled", "SSSD" if options.sssd else "LDAP")
 
             if options.sssd:
+                if selinux_works and configure_selinux_for_client is not None:
+                    configure_selinux_for_client(statestore)
+
                 sssd = services.service('sssd', api)
                 try:
                     sssd.restart()