Adds 'reason' for xfail on PaX tests

Rightfully pointed out by @heartsucker during review. Cross-linked to
relevant issue. As to why we're using xfail rather than skip, the
"strict" setting on xfail will alert us if the tests unexpectedly start
passing (ain't that the dream?).

molecule/testinfra/staging/common/test_grsecurity.py

@@ -143,7 +143,9 @@ def test_apt_autoremove(Command):
     assert "The following packages will be REMOVED" not in c.stdout
 
 
-@pytest.mark.xfail(strict=True)
+
+@pytest.mark.xfail(strict=True,
+                   reason="PaX flags unset at install time, see issue #3916")
 @pytest.mark.parametrize("binary", [
     "/usr/sbin/grub-probe",
     "/usr/sbin/grub-mkdevicemap",