[Community fork] selinux: add sshd_session_t and sshd_auth_t rules for RHEL 10 / OpenSSH 9.8+

What does this MR do and why?

Fixes git-over-SSH on RHEL 10 / AlmaLinux 10 with SELinux in Enforcing mode. Opened from the community fork (https://gitlab.com/gitlab-community/gitlab-org/omnibus-gitlab) against canonical master, following the same route as !9577 (merged).

Original problem: OpenSSH 9.8 (shipped as openssh-server-9.9p1 on RHEL 10 / AlmaLinux 10) split the sshd daemon into a listener (sshd, still sshd_t) and a per-connection handler (sshd-session, running in the new sshd_session_t domain). Authentication now runs in sshd_session_t, but the existing GitLab SELinux modules only grant sshd_t access to the gitlab_shell_t-labelled /var/opt/gitlab/.ssh/authorized_keys. As a result, sshd-session cannot read the authorized keys file and every SSH key is rejected.

AVC denials observed on gitlab-ee-19.2.1-ee.0.el10:

scontext=sshd_session_t tcontext=gitlab_shell_t denied { search } on .ssh dir
scontext=sshd_session_t tcontext=gitlab_shell_t denied { read open getattr } on authorized_keys

Fix:

1. files/gitlab-selinux/gitlab-19.4.0-sshd-session.te (new file) — standalone SELinux module granting sshd_session_t (OpenSSH 9.8+, RHEL 10) and sshd_auth_t (OpenSSH 10.0+, Fedora 43) the necessary dir and file permissions on gitlab_shell_t objects. Both types are wrapped in raw optional blocks (checkmodule performs no m4 expansion, so the optional_policy macro is not available) so the module installs cleanly on RHEL 7/8/9 where those types do not exist. The dir grant is scoped to { search getattr }, matching the AVCs in #10048 (closed) plus the StrictModes directory stat.
2. files/gitlab-selinux/gitlab.te (updated, version 1.0.0 → 1.1.0) — adds the same raw optional blocks to the unified policy, adds the missing dir class declaration, and removes a duplicate type sshd_t require entry.
3. files/gitlab-cookbooks/gitlab/recipes/selinux.rb (updated) — installs the new standalone module in the non-unified path; removes it (migrating to the unified policy) in the unified path. Follows the same pattern as the earlier fix for gitlab-13.5.0-gitlab-shell.
4. spec/chef/cookbooks/gitlab/recipes/selinux_spec.rb (updated) — adds ChefSpec tests covering both the unified and non-unified code paths for the new module.

The config/software/gitlab-selinux.rb build script already compiles all *.te files in files/gitlab-selinux/ via checkmodule + semodule_package, so no build script changes are needed.

Closes #10048 (closed).

Attribution

Credit for the root cause analysis, the upstream Fedora/RHEL policy references, and the workaround module this fix is based on goes to @dimasmjunior, the author of the bug report #10048 (closed). Supersedes the draft !9668 (closed), recreated here via the community fork as a community contribution.

Testing

• Bug reproduced on gitlab-ee-19.2.1-ee.0.el10 (AlmaLinux 10.2, SELinux Enforcing): SSH fails Enforcing, succeeds Permissive; AVC denials match the report.
• The equivalent sshd_session_t allow rules (installed as a local module) confirmed to restore git-over-SSH with SELinux back in Enforcing mode on the same host.
• ChefSpec tests added for both the unified and non-unified policy code paths.

Checklist

• Tests added for new functionality
• Latest Merge Result pipeline is green
• Documentation (no user-facing config change)