Let <path-permission> block unprotected providers.

When accessing a ContentProvider that is unprotected by top-level
permissions, and caller doesn't hold a matching <path-permission>
permission, revoke the default top-level access.

This enables an otherwise unprotected provider to enforce permissions
on specific paths.

Bug: 6131916
Change-Id: Icab89f765ccd90b1acea6988b05f00877fe2c11e