To run a daemon in a unique domain in SE Linux you need a daemon-specific
label on the program that is run.  If the ExecStart line directly runs a
program that's not daemon specific (EG uwsgi, perl, bash, etc) then this
doesn't happen.  The systemctl edit command doesn't allow overwriting the
ExecStart entry, so the only thing to do with the package in it's current
form on SE Linux is to change the /lib/systemd/system/mailman3-web.service
file.

If instead you had ExecStart=/usr/sbin/mailman3-web-start or something
similar then I could have the Debian SE Linux policy assign a specific
label to that file and it would get the right context without any
changes being needed.

NB no change is needed for the mailman3 package because /usr/bin/mailman
is a symlink to /usr/lib/mailman3/bin/mailman which is a program that is
specific to mailman.