Add an App Protection Service role

This is a new, exclusive role for a system app that is able to access
application behavior data in order to detect potentially harmful behavior.

Currently, this role will have access to historical app ops via the new
GET_HISTORICAL_APP_OPS_STATS permission.

Security review: b/196982126

Bug: 204929538
Test: manual build and install
Change-Id: I9bd4cfcfed0419b5136a08d314c65572519af3db