Claude review: selinux: Restrict cross-cgroup dma-heap charging

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

Implements the SELinux side with a new `dma_heap` class and `charge_to` permission.

```c
+static int selinux_dma_heap_alloc(const struct cred *from, const struct cred *to)
+{
+	return avc_has_perm(cred_sid(from), cred_sid(to),
+			    SECCLASS_DMA_HEAP, DMA_HEAP__CHARGE_TO, NULL);
+}
```

This looks correct and follows established SELinux patterns. The `NULL` ad (audit data) parameter means no additional audit context is logged beyond the SIDs and permission. For debugging, it might be helpful to provide ad context (e.g., the heap name or allocation size), but this is optional.

**Minor:** The new class is added at the end of `secclass_map` before the `{ NULL, {} }` sentinel, which is the correct location.

---
Generated by Claude Code Patch Reviewer