[pm] prevent installations of apex packages with permission declarations

We should probably also restrict other types of declarations, such as
activities, but to reduce the potential impact, this CL only limits the
permission declarations.

BUG: 301320911
Test: manually by trying to install an apex with or without permission
declarations
Test: expected error is thrown before the session is staged

$ adb install /sdb/main/out/target/product/oriole/system/apex/com.google.android.devicelock.apex
Performing Streamed Install
adb: failed to install /sdb/main/out/target/product/oriole/system/apex/com.google.android.devicelock.apex: Error [-22] [Failed to parse APEX package /data/app-staging/session_2027984736/base.apex : com.android.internal.pm.parsing.PackageParserException: /data/app-staging/session_2027984736/base.apex (at Binary XML file line #17): com.google.android.devicelock is an APEX package and shouldn't declare permissions.]

Test: cts to be added

Change-Id: I6c9860756a46778493a8a12348a162cbd209af3f