selinux: don't revalidate an inode's label when explicitly setting it