Move dropping implicit UPGRADE_EXEMPT into permission policy.

Because the implicit UPGRADE_EXEMPT is added by permission
policy. Also fixes the issue that may occur when system and non-system
apps shares the same UID.

Bug: 263504888
Test: presubmit
Change-Id: Ib148df813b4e2fbbec783fb3eb2b795a339e50eb