Expand apps' control over the settings restore process

Applications can now specify two more aspects of the restore process:  whether
they need to run with their own custom Application subclass rather than being
launched in the usual restricted mode during restore, and whether it's okay for
the backup manager to kill the app process once restore has completed.  The new
manifest attributes for these are, respectively, android:restoreNeedsApplication
and android:killAfterRestore.

If unspecified in the manifest, restoreNeedsApplication is false, and
killAfterRestore is true.

In order to support kill-after-restore cleanly, this change also adds a new
system-process-only interface to the Activity Manager, which will schedule a
"commit suicide" event on the target app's main thread looper.

The framework backup agents have been given the appropriate new backup
attributes as well.