fix(configuration): disable selinux with selinux=0 on el9 when the feature is off

roles/configuration/tasks/grub.yml

@@ -43,11 +43,14 @@
           }}
         grub_root_flags: >-
           {{ ['rootflags=subvol=@'] if system_cfg.filesystem == 'btrfs' else [] }}
+        grub_selinux_args: >-
+          {{ [] if system_cfg.features.selinux.enabled | bool else ['selinux=0'] }}
         # String-concat (not list-concat like grub_kernel_cmdline_base below): ansible-lint's
         # jinja render trips on list+list when grub_lvm_args leads the expression here.
         grub_cmdline_linux_base: >-
           {{
-            ((grub_lvm_args | join(' ')) ~ ' ' ~ (_hardware_profile_kernel_params | default([]) | join(' '))) | trim
+            ((grub_lvm_args | join(' ')) ~ ' ' ~ (grub_selinux_args | join(' ')) ~ ' '
+             ~ (_hardware_profile_kernel_params | default([]) | join(' '))) | trim
           }}
         grub_kernel_cmdline_base: >-
           {{
@@ -57,6 +60,7 @@
               + ['ro']
               + grub_lvm_args
               + grub_root_flags
+              + grub_selinux_args
               + (_hardware_profile_kernel_params | default([]))
             )
             | join(' ')