selinux: check ss_initialized before revalidating an inode label