Enforce permitted_packages for Q+ and R+ modules

Q+ and R+ mainline modules may only add code in a restricted set of Java
package prefixes, that may never be changed.
If a mainline module owns the Java package prefix "foo.bar", it may have
classes in "foo.bar", "foo.bar.baz", "foo.bar.baz.bat" etc.

Test: m
Bug: 156725734
Change-Id: I30bf510ed473309871469bf439d7c81575450931