Allow non system to set perm policy flags - needed by the installer

My previous change overtightened which permission flags can be changed
by a non-system caller. This took away the capability of the package
installer to set policy flags which it needs to implement the auto
grant/deny behavior.

bug:22776149

Change-Id: Ic2a82bedc413fc91360c3bcec355fac456f0fccf