audio policy: check permissions for AUDIO_INPUT_FLAG_HW_HOTWORD

Allow audio capture with AUDIO_INPUT_FLAG_HW_HOTWORD only if the
caller has CAPTURE_AUDIO_HOTWORD permission granted. While at it,
update the return code to PERMISSION_DENIED for other permission
checks as well.

Bug: 178654411
Test: tested by setting hotword mode from AGSA application that has the
required permission. Able to see hal opened with correct flag.
Test: Forced to always return error if flag was set and verified
AudioRecord starting in application fails.

Change-Id: I827ab5933621bff71a96164e40026ecccf1ba44f