nfs: set security label when revalidating inode