Add new OEM permission flavor

The new OEM permission flavor of signature protected perissions
can be granted only to apps on the OEM partition if they are:

 1. Signed as the one declaring the permission

 2. The requesting app is on OEM partition of the system image and
    declares the permission used and the OEM explicitly granted this
    permission by adding an entry in /oem/permission/*.xml
    with the following format:

    <permissions>
        <oem-permissions package="foo.bar.baz">
            <permission name="android.permission.ACCESS_FOO" granted="true"/>
        </oem-permissions>
    </permissions>

All OEM permissions requested by any app on the OEM partition
must be declared granted or not to force the OEM making a well
though out explicit choice. If that condidtion is not met the
system server restarts - this prevents shipping a device with
OEM permissions for which no opition was explicitly expressed.

Normal apps requesting an OEM permission has no effect, i.e the
permission is only granted on a signature match.

Change-Id: I345bb0b56368ee03e4bd768faab540ee4e0571ae
Bug: 65497745
Test: Manual