Don't use this. It's just for me, and only temporarily until this stuff all lands in the Fedora (and ideally upstream) selinux-policy.
In the future, this will likely include an ostree_t domain. For now, this is just a few additional allow rules.