Show even fewer notifications in Setup.

Restricting to pkg="android" didn't filter out things like
open wifi networks, etc. So now we have a whitelist:
notifications must be sent the "android" pseudo-package,
*and* they must have one of these "kind" tags:

  - android.system.imeswitcher (IME switcher, needed by SUW)
  - android.system.update (OTAs)

Note that OTAs currently use a fullScreenIntent, so they
bypass this logic anyway, but for consistency's sake we now
allow OTA icons in the status bar explicitly.

Bug: 6645469
Change-Id: Ib2e2f22d7a0817a1acaf8137ed4f3c7d3ddf8af5