Label /run/bootupd-lock with bootupd_var_run_t.
Allow bootupd manage files in /boot.
Allow bootupd execute generic executables.
Allow bootupd execute bootloader, mount, udev with a transition.
Allow bootupd read generic certificates.
Allow bootupd read sysfs files.
Allow bootupd use inherited user domain ptys.

Resolves: rhbz#2300306