sepolicy: Fix regressions from introduction of sepolicy_new_at()

sepolicy: Fix regressions from introduction of sepolicy_new_at()

Being bitten by lack of PR testing here.  There are two bugs:

- First and foremost, I forgot that GObject will call the property setters with
  the defaults.  This meant we were getting both path="/var/tmp/blah" and fd=-1,
  and we were accepting -1 as a fd, which then got converted into AT_FDCWD
  which was wrong.
- Since these properties are construct only and mutually exclusive, don't
  try to handle one resetting the other.  Assert that exactly one of them is set.

Closes: #769
Approved by: jlebon