Only installd and init may relabel app_data_file.

Bug: 78517829
Test: build aosp_sailfish-userdebug
Change-Id: I5e1a97b9fb6fa9ff9fd49e1e664769ae70aeda37

public/domain.te

@@ -1187,6 +1187,12 @@ neverallow {
   -installd # creation of sandbox
 } app_data_file:dir_file_class_set { create unlink };
 
+neverallow {
+  domain
+  -init
+  -installd
+} app_data_file:dir_file_class_set { relabelfrom relabelto };
+
 #
 # Only these domains should transition to shell domain. This domain is
 # permissible for the "shell user". If you need a process to exec a shell