Only report permissions that require re-evaluation as changed.

A re-evaluation is only needed when the permission's owning package
changed, or protection level (protection + protection flags) changed,
or a runtime permission is moved to a new group. This helps us
significantly reduce the re-evaluations needed during boot.

Also fixed the issue that config permissions aren't turned into
manifest permissions when they matched. This is important because we
don't persist config permissions, but we do want to persist
permissions from APK manifest.

Also renamed isPermissionTypeChanged to isPermissionProtectionChanged
for clarity, and improved logging in one place.

Bug: 284205103
Test: presubmit
Change-Id: I176a60289d94363d665b6b4da33cbb00f989a8bd