selinux: Implement the watch_key security hook