CONFIG_LSM is a new option which can be used to enable SELinux. Base
Fedora config does that. When disabled at runtime only, SELinux-aware
kernel will refuse setting securit.selinux xattr, breaking multiple
tools, including initramfs generation (cp --preserve=xattr fails).
The config is now generated based on Fedora's config. This way we need
to only track qubes specific changes and can quickly update to never
Fedora configs.