selinux: ensure that the cached NetLabel secattr matches the desired SID