aa_label_remove needs to take the ls write lock but, we are already
holding it so move to __aa_label_remove

also fix bug where the old label is not being forwarded to the new label
when it results in a new namespace due to an the old ns being removed.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>