selinux: replace some BUG_ON()s with a WARN_ON()