Enforce debugfs restrictions for S launching devices and newer

Starting with Android R, debugfs cannot be mounted on production
devices. In order to minimize the differences w.r.t debugfs between user
and userdebug/eng builds, enforce a set of run-time and build-time
restrictions on debugfs access for S launch devices and newer. For
non-user builds, debugfs can still be accessed by root and by the
dumpstate HAL during bugreport collection.

Bug: 184381659
Test: build/boot
Change-Id: I2af49acd8a5b3440c6ecbf365ab43cdb33ff897a