selinux: delay mac_selinux_enforcing call after SELinux was determined to be enabled

Calling `mac_selinux_enforcing()`, which calls `security_getenforce()`, on a SELinux disabled system causes the following error message to be printed:
    Failed to get SELinux enforced status: No such file or directory

Fixes: 257188f8 ("selinux: cache enforced status and treat retrieve failure as enforced mode")
Supersedes: #15145