selinux: inline avc_audit() and avc_has_perm_noaudit() into caller