Fix allowlist token issues

1) Don't accept enqueued notifications with an unexpected token.
2) Ensure allowlist token matches for all parceled and unparceled notifications (by only using the "root notification" one).

Bug: 320659371
Bug: 322326520
Bug: 322819634
Bug: 305695605
Test: atest NotificationManagerServiceTest ParcelTest + manually
Change-Id: I232e9b74eece745560ed2e762071b48984b3f176