docker: upgrade to 19.03.12

[samuelkarp]

Description of changes:
Upgrade docker-engine and docker-cli to 19.03.12.

Testing done:
Built and ran both the aws-dev and aws-ecs-1 variants. Both variants are able to run containers. docker version output looks reasonable.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[tjkirch]

nits: lost final newline, and space before }

[jamieand]

Where does this timestamp come from?

[samuelkarp]

This is, as near as I can tell, Docker's birthday. (The date and time of this talk.)

[samuelkarp]

--security-opt label:disable appears to have different behavior now; in the previous version of Docker it would successfully disable all process and mount labeling. With this upgraded version of Docker, I'm still seeing the system_u:system_r:container_t:s0 process label and system_u:object_r:local_t:s0:c322,c990 mount label applied. --security-opt label:type:super_t behaves as expected.

[samuelkarp]

Discussed with @bcressey offline; we believe the change in behavior is fine for now, it ends up with strictly more-compatible behavior for the case where label:disable is provided (the container can actually write to its rootfs). We'll need to revisit a little when we revise our SELinux policy for MCS enforcement as the rootfs mount currently has an MCS pair but the process does not.