cameraserver: address selinux denials

avc: denied { search } for name="graphics" dev="tmpfs" ino=16110 scontext=u:r:cameraserver:s0 tcontext=u:object_r:graphics_device:s0 tclass=dir permissive=0
avc: denied { read write } for name="diag" dev="tmpfs" ino=16005 scontext=u:r:cameraserver:s0 tcontext=u:object_r:diag_device:s0 tclass=chr_file permissive=0

Test: marlin builds and boots. Denials are gone.
Bug: 35197529
Change-Id: I2ce3014bcc7ee144ea8256cd95233944105ded87
(cherry picked from commit f9ec574e6650e72a9d236bf403434d1395267d31)
diff --git a/sepolicy/cameraserver.te b/sepolicy/cameraserver.te
index aeeeb56..9480806 100644
--- a/sepolicy/cameraserver.te
+++ b/sepolicy/cameraserver.te
@@ -34,3 +34,9 @@
 # allow cameraserver to call some socket ioctls
 allowxperm cameraserver self:socket ioctl { IPC_ROUTER_IOCTL_LOOKUP_SERVER IPC_ROUTER_IOCTL_BIND_CONTROL_PORT };
 
+# ignore spurious denial
+dontaudit cameraserver graphics_device:dir search;
+
+userdebug_or_eng(`
+  allow cameraserver diag_device:chr_file rw_file_perms;
+')