Writing /.autorelabel from fedora-autorelabel does not work because the
script is executed only if relabel was already requested.

Create a new unit fedora-autorelabel-mark.service which will be
responsible for creating /.autorelabel if SELinux is disabled.
The unit takes advantage of the new "ConditionSecurity=" support in
systemd.

The old script checked for a read-only filesystem first. The new unit
does not do that. If / is read-only, touch will simply fail. This should
not be considered as a failure of the unit, so "-" is used in ExecStart.

There have been arguments on systemd-devel that the root directory
should not be abused for flag files like /.autorelabel. It has a long
tradition in Fedora though (since 2005). Maybe we can change it
eventually, but let's keep it where it is for now.

The result of the check is needed only once, so there's no advantage in
caching it in a variable.

The service unit file already checks whether /.autorelabel or the
"autorelabel" parameter are present. No need to recheck in the script.
Using the new "ConditionSecurity=" feature systemd can also check
whether SELinux is enabled.

Also, merge blocks on identical conditions.