quoted

... or we find a better placement in the VFS for
security_inode_free(), is that is possible.  It may not be, our VFS
friends should be able to help here.

The place where you do it currently is pretty good. I don't see an easy
way to call it from somewhere else without forcing every filesystem to
either implement a free_inode or destroy_inode hook.