sepolicy: add rules for updater and update_engine

* We need special exceptions for update_engine scripts because we
  handle backuptool operations through it.

* priv_app needs to be able to make ota package dirs in order to
  put the ota in the correct spot.

Change-Id: I42a421e4d84adde9514932a056c082d1cb3e09b4