mount: apply SELinux labels before overlayfs mount