Pass targetSdkVersion specifier for SELinux labeling

Motivation:
Provide the ability to phase in new security policies by
applying them to apps with a minimum targetSdkVersion

Test: Marlin builds and boots. Apps targeting targetSdkVersion<=25
run in untrusted_app_25 domain. Apps targeting the current development
build >=26 run in the untrusted_app domain with fewer permissions. No
new denials observed during testing.
Bug: 34115651
Change-Id: Ib9f6ded9bd2f426861a6d843861b4074084253b0