SELinux: deterministic ordering of range transition rules