DPM: Add API for granting apps access to keys

Add a DevicePolicyManager method for granting (or revoking) access to a
key for a specific package.

This prevents apps from having to call KeyChain.choosePrivateKeyAlias to
get a grant for the alias.
The motivation for this change is that apps that run as a background
service do not have an Activity to pass into
KeyChain.choosePrivateKeyAlias any more as they are not allowed to
interact with users.
That creates a situation where even though the Device Policy Client
would silently grant the requesting app access to a KeyChain key, the
app still has to provide an Activity.

With this change, the DPC can pre-grant the app access to a key such
that the app does not need to call KeyChain.choosePrivateKeyAlias and
can instead just call KeyChain.getPrivateKey

BUG: 137921026
Test: atest CtsDevicePolicyManagerTestCases:com.android.cts.devicepolicy.MixedDeviceOwnerTest#testSetKeyGrant
Change-Id: I37a75e1f802e223740eb41f055224baba9aa3b3a