appops: Finish started proxy op when chain fails

A more precise version of I92060d44e666fa6725411de5d714ac0d380f42ae

This fixes an issue where we finish the op which failed permission
checks... which causes refcount mismatches again.

Instead, ensure that we finish only the proxy ops which were
*successfully* started: acheiving this by pushing the cleanup into the
checkPerm loop which iterates through the attr chain.

Technically this should also be added for appop permissions, but focus
on runtime appops for now, since that is where the security issue is.

Test: CtsMediaAudioPermissionTestCases
Bug: 293603271
Flag: EXEMPT security
Change-Id: Ifced9449e47b09c7a1a9982c73d4871302a742a2