security-manager: use Smack label for verifying Cynara rules, not pkgId