Description of problem:
My confined container can't mount an overlay filesystem, even though it's in its own user namespace.

Version-Release number of selected component (if applicable):
container-selinux-2.173.1-0.rhaos4.10.el8.6

How reproducible:
Always

Steps to Reproduce:

1. Bring up an OpenShift 4.11 development cluster.

2. `oc apply -f` this pod spec, which includes annotations which tell CRI-O to run the pod's containers in a user namespace:
---
apiVersion: v1
kind: Pod
metadata:
  name: overlay-mount-test
  annotations:
    io.openshift.builder: ""
    io.kubernetes.cri-o.userns-mode: "auto:size=65536"
spec:
  volumes:
    - name: plain
      emptyDir:
  containers:
    - name: userns-test
      image: registry.redhat.io/ubi8/ubi
      volumeMounts:
        - mountPath: /test
          name: plain
      securityContext:
        capabilities:
           add:
             - CAP_SETFCAP
      command: ["sh", "-c", "mkdir -p /test/lower /test/upper /test/work /test/merged; unshare -Urm mount -t overlay -o lowerdir=/test/lower,upperdir=/test/upper,workdir=/test/work overlay /test/merged && echo success || echo failure ; sleep infinity"]

3. Use `oc logs pod/overlay-mount-test` to see if it succeeded.  If it failed, use `oc describe pod/overlay-mount-test` to figure out which node the pod ran on, `oc debug node/$node` to get onto the node, then chroot and use ausearch to find out why.

Actual results:
The mount command failed.  Running the audit log through audit2allow suggests "allow container_t fs_t:filesystem mount;", among other things.

Expected results:
The mount command should have succeeded.

Additional info:
This should be allowed by https://github.com/containers/container-selinux/pull/181, but we need to backport it.