bottlerocket avc denial absence test

[webern]

When running a normal container workload we want to check and make sure no selinux avc denials occur. This probably needs to be modeled as a workload test, and it cannot happen on the same node as a test that is checking that avc denials do occur (#433).

depends on:

• #419
• #429

[webern]

@bcressey this is of interest to you