ASM Opt-In flag clean up.

This change cleans up some of the changes introduced in change-id
I4668de42dc41a78778166aa053b723a36b49f32b.

1. Address a few places where ASM checks could still be performed even
   if the top activity has not opted in.
2. Remove the grace period exception for activities which have opted-in.
   As we swap to an off-by-default model, we can trial being more
   restrictive here, and loosen policies based on feedback.
3. Makes more strict a handful of other checks - if we end up in an
   unexpected situation, we block.
4. Opt in system components
5. Allow most BAL exemptions to also apply to clearing a task

Bug: 322913638
Test: atest ActivitySecurityModelTest
      ActivitySecurityModelEmbeddingTest BackgroundActivityLaunchTest
Change-Id: Ibf44a114dd792397c441d04bfc9de9e458347e62