Restrict access_mtp permission access to Android/

Ensure only platform signed apps holding the access_mtp permission can
access the sensitive Android/

TODO: On devices without sdcardfs, will also need to give the two new
ext_data_rw and ext_obb_rw gids to these processes. May need to do
same for apps with pass_through mount mode as well

Test: MTP app still has sdcard_rw
Bug: 148555237

Change-Id: I140a2ffec8a5887c7cd25d6976ee19555f2a47c1