selinux: support deferred mapping of contexts